+ iHj$(aERmEtC0tRt^RIt^RIt^RIt^RIt^RIt^RIt^RIt^RI t ^RI t ^RI t ^RI t ^RI t ^RIHt^RIHtHtHtHtHtHtHtHtHt^RIHtHtHt^RIHtH t H!t!H"t"H#t#^RI$H%t%H&t&H't'H(t(H)t)^RI*H+t+^RI,H-t-H.t.^R I/H0t0H1t1H2t2^R I3H4t5H6t7H8t9H:t;^R IH?t?]'d^R I@HAtARsB]^kRRltC!RR4tD]D!4tA] P!4tF!RR4tGRRltH]PR4tJ^RIKHLtL^RIMHNtNHOtO^RIPHQtQ^RIRHStSHTtT^RIUHVtV^RIWHXtX^RIYHZtZH[t[H\t\H]t]^RI^H_t_H`t`HataHbtbHctc^RIdHeteHftf^R IgHhthHitiHjtjHktkHltlHmtmHntn]P!]p4tq]r!4ts]^k]r!4tt]^k]r!4tu]^k]r!4tv]^kR!R"ltwR#sxR$R#/R%R&lltyR'R(ltz] P!4t{!R)R*]|4t}R+R,lt~R-R.lt]PERnR0R1ll4tR2R3ltR4R5lt!R6R74t] P!4t] P!4t] P!4t] P!4tR8R9ltR:R;ltR<R=ltR>R?ltR@RAltRBRCltERoRDRElltRFRGltRHRIltRJt]PRKRLl4t]PRM4tRNROlt]PRPRQl4tRRRSltRTRUltRVRWltRXRYltR#sRZR[R\R[R]R[R^R[R_R[/tRs]^kR`RaltRbRclt]!4t]^kRdReltRfRgltRhRiltRjtRktERoRlRmlltRnRoltERoRpRqlltRrRslt]r!4t]^kRtRultERpRvRwlltERoRxR//RyRzllltERqt]^kERrt]^ kR~RltRRltRR#/RRlltRR{RRRRRRRRRRRRRRRRRRRRRRRRRR/t]^ k]t]^ k]!R04t]^ kRRltRRRR/t]^ kRRlt]!RR04t]^kRRRRRR/tRRltERoRRlltRR/tRRlt^RIHtRRRRRR]!4EP 2/t^RIHtRRltR#s]^kRtRtRtRt]V!4R, t]tRtERstERttRRltRRltERuRRlltRRltERoRRlltRRltERuRRllt]!R04tRRltRRltRRltRRltRRltRt!RR4t!RR4t!RR4t!RR4t!RR4t]t!RR4t!RR]4tRRlt!RR4t!RR4t!RR]4t!RR4t!RR4t!RR]4tRRltERoRRlltRRltRRltRR#/RERlltRR#ERR/ERERlltERERltERERltERER ltER ER ltER ER ltERR#ERR#/ERERlltERERlt]r!4t]^kERERltERERltERERltERvERERllEtERoERERllEtERwERERllEtER ER!lEtER"R#/ER#ER$llEt]EP !E]ER%R/ER&7Et]EP !E]ER'R/R/ER(7Et]EP !E]ER)R#ER&7Et]EP !E]ER*R#ER&7Et ER+ER,lEt ER-ER.lEt ER/ER0lEt REs ]^kREs]^kREs]^kREs]^kREs]^kREs]^k]EP&!ER1RER27Et]^k]EP&!ER3RER27Et]^k]PER4ER5l4EtER6EtER7EtER8ER9lEtER:ER;lEtER'RERllEtER'RERlEtER?ER@lEtERAERBlEtERCERDlEtEREERFlEtERGERHlEtERoERIERJllEtERKERLlEtERMERNlEtEROERPlEtERQERRlEtERSERTlEtERUERVlEtERWE]ERsE]ERtE]ERvE]ERE]R[E]/Et]^kERERXERYllEtERuERR/ERZER[lllEtEREtER]ER^lEtER_ER`lEtERaERblEtERERcERsERdERtEReERvERfRERgER\E]R[ERh/Et]^kERoERiERjllEtERkERllEtERmERnlEtERoERplEtERqERrlEtEREtERpER*RER)RR$R#ERR/ERsERtlllEtERuERvlEtER%R/ERwERxllEt/Et]^ k] EP@!4Et^@Et!ERyERz4EtER{ER|lEtER*RER)RERER?llEt0ER@ERAlEt1ERBERClEt2ERDERElEt3ERFERGlEt4ERoERHERIllEt5ERJERKlEt6E]ERoER'RER%RER*RER)RERRERLRERMRERNRERORERPRERQRERREREReEt?ERfR/ERgERhllEt@E]ERoER'RER%RER*RER)RERRERLRERMRERNRERORERPRERQRERTR/ ERiERjlll4EtAERoER'RER%RER*RER)RERRERLRERMRERNRERORERPRERQRERTR/ ERkERllllEtBR#(uVShared auxiliary client router for side tasks (compression, search, vision, ...). Text auto chain: main provider+model → OpenRouter → Nous Portal → custom endpoint → native Anthropic → direct API-key providers → None. Vision auto chain: main provider (if a supported vision backend) → OpenRouter → Nous → Anthropic → custom. ``auxiliary.free_only`` restricts the OpenRouter lane to ``:free`` SKUs. Codex OAuth is in neither chain (undocumented, shifting allow-list): main provider or explicit ``auxiliary..provider`` only. HTTP 402 in call_llm() falls through the chain. N)SimpleNamespace) AnyCallableDictList NamedTupleOptionalTuple TYPE_CHECKINGUnion)urlparseparse_qs urlunparse)PromptReadingClockcurrent_prompt_reading_hookprompt_progressprompt_reading_hookwith_prompt_progress)_BILLING_PATTERNS_OVERLOADED_PATTERNSUNSUPPORTED_PARAM_MARKERSis_reasoning_field_rejectionis_reasoning_required_rejection)_is_managed_local_endpoint)remember_reasoning_floorwith_reasoning_floor) _route_key!_without_structured_output_format$remember_structured_output_rejection)CODEX_AUX_BASE_URLapply_required_codex_headerscodex_cloudflare_headersis_official_codex_base_url)_codex_event_has_content)!bypass_chat_sdk_request_transformOpenAIc$V^8dQhR\/#return)type)formats";/home/ubuntu/.hermes/hermes-agent/agent/auxiliary_client.py __annotate__r.9s$c.\f ^RIHpVs\#)z#Import and cache ``openai.OpenAI``.r%)_OPENAI_CLS_CACHEopenair&)_clss r-_load_openai_clsr49s )  r/c:a]tRt^BtoRtRtRtRtRtRt Vt R#) _OpenAIProxyzbLazy stand-in for ``openai.OpenAI``: forwards calls and isinstance checks, importing on first use.c"\4!V/VB#N)r4)selfargskwargss&*,r-__call___OpenAIProxy.__call__Fs!42622r/c*\V\44#r8) isinstancer4)r9objs&&r-__instancecheck___OpenAIProxy.__instancecheck__Is#/122r/cR#)zr9s&r-__repr___OpenAIProxy.__repr__Ls+r/rDN) __name__ __module__ __qualname____firstlineno____doc__ __slots__r<rArF__static_attributes____classdictcell__ __classdict__s@r-r6r6Bs!lI33,,r/r6cba]tRt^YtoRtRtR V3RlRlltV3RlRltV3RlRltRt Vt R #) _AuxProbeClientStubzENon-functional placeholder returned while `aux_probe_mode` is active.c*<V^8dQhRS[RS[RR/#)r)api_keybase_urlr*Nstr)r,rQs"r-r. _AuxProbeClientStub.__annotate__]s"!!!C!!r/cWnW nR#r8rUrV)r9rUrVs&&&r-__init___AuxProbeClientStub.__init__]s   r/c&<V^8dQhRS[RS[/#r)namer*rXr)r,rQs"r-r.rYas>>>>r/c"\RV: R24h)z5_AuxProbeClientStub used as a real client (attribute z1); aux_probe_mode is for availability checks only) RuntimeError)r9r`s&&r- __getattr___AuxProbeClientStub.__getattr__as!CD8L= => >r/c <V^8dQhRS[/#r(rW)r,rQs"r-r.rYgs66#6r/cR#)z$rDrEs&r-rF_AuxProbeClientStub.__repr__gs5r/r[Nrj) rHrIrJrKrLrMr\rdrFrNrOrPs@r-rSrSYs+O'I!!>> 66r/rSc$V^8dQhR\/#r(bool)r,s"r-r.r.ks<<4A) load_pool)entry_scoped_poolpool_for_aux_provider)data_use_requirement)MINIMUM_CONTEXT_LENGTHget_model_context_length)get_hermes_home)_canonical_api_mode)_custom_health_base_url_unhealthy_cache_key!fallback_candidate_quarantine_ttl%fallback_candidate_unavailable_reason)AuxiliaryClientUnavailableclear_nous_credential_failure$missing_provider_credentials_messagenous_credential_failure_detailrecord_nous_credential_failure)OPENROUTER_BASE_URLhermes_home_key)base_url_host_matchesbase_url_hostnamebase_url_origin env_floatis_truthy_value"model_forces_max_completion_tokensnormalize_proxy_env_varscFV^8dQhR\\,R\/#r)rVr*)rrXr)r,s"r-r.r.s  (3- C r/c^RIHp^RIHpHpT!\ T;'gR4V!4R7pT!VP R4VP R4\ T;'gR4R7# \dR#i;i) uhttpx ``verify`` for an aux base_url, mirroring the main client (per-provider ``ssl_ca_cert`` / ``ssl_verify``; otherwise the OS trust store); any failure → httpx default (``True``).)resolve_httpx_verify) get_custom_provider_tls_settingsload_config_readonlyrjconfig ssl_ca_cert ssl_verify) ca_bundlerrVT)agent.ssl_verifyrhermes_cli.configrrrXget Exception)rVrrrtlss& r-_resolve_aux_verifyrsr9\.s8>>r/BK_Kab#ggm,9NY\]e]k]kikYln n sA.AA." A.. A=<A=F async_modectV^8dQhR\\,R\R\\\3,/#)r)rVrr*)rrXrmdictr)r,s"r-r.r.s7AA#AtAX\]`be]eXfAr/c^RIHpT!\T;'gR4V\V4R7pVeRV/#/# \\ 3d)\ 'gRs\PR4RpLBi;i)zKInject keepalive httpx client with env-only proxy (not macOS system proxy).)build_keepalive_http_clientrj)rverifyTuagent.process_bootstrap.build_keepalive_http_client is unavailable — mixed/stale install detected (#64333). Falling back to the SDK default HTTP client. Run `hermes update` (or reinstall the Desktop app) to resync the runtime.N http_client) agent.process_bootstraprrXr ImportErrorAttributeError_WARNED_KEEPALIVE_IMPORT_SKEWloggerwarning)rVrrclients&$ r-_openai_http_client_kwargsrsG, B J?RS[?\^'-&8M6 "@b@  ( -,,0 ) NND E  s99A2A21A2cHV^8dQhR\R\R\R\/#)r)rUrVr;r*ra)r,s"r-r.r.s.@@c@S@C@C@r/c \4'd \WR7#/\V4CVCp\W VR7VP R^4\ RRVRV/VB#)r[ access_tokenrV max_retriesrUrVrD)rsrSr_apply_required_codex_headers setdefaultr&)rUrVr;s$$,r-_create_openai_clientrs_"7FF ?*84 ? ?F!&R mQ'  ?' ?H ? ??r/cFaa]tRt^toRtRtV3RlV3RlltRtVtV;t #)AuxiliaryExplicitCancellationa%Frozen signal that an auxiliary attempt was explicitly hard-cancelled. ``BaseException`` so broad ``except Exception`` retry/fallback code never treats a host stop as a transport failure; ``cause`` is immutable class data so nothing re-queries a mutable host Event after the transport unwound.explicit_host_cancelc<V^8dQhRR/#r)r*NrD)r,rQs"r-r.*AuxiliaryExplicitCancellation.__annotate__sKK$Kr/c&<\SV`R4R#)z.auxiliary request explicitly cancelled by hostN)superr\)r9 __class__s&r-r\&AuxiliaryExplicitCancellation.__init__s IJr/rD) rHrIrJrKrLcauser\rNrO __classcell__)rrQs@@r-rrs$g #EKKKr/rc$V^8dQhR\/#r(rl)r,s"r-r.r.sEE$Er/c6\\\RR44#ro)rmrq_aux_interrupt_protectionrDr/r-_aux_interrupt_protectedrs 18UC DDr/c$V^8dQhR\/#r(rl)r,s"r-r.r.sQQQr/c8\4pVe \V4#R#)z@Return whether an explicit host cancel overrides aux protection.F)_capture_aux_cancel_check_captured_aux_cancel_requested)checks r-_aux_interrupt_cancel_requestedrs % 'E494E )% 0P5Pr/Tc$V^8dQhR\/#)r)rprl)r,s"r-r.r.sCCTCr/c#"\\RR4p\\RR4p\\RR4pV\n\V4'd V\nVe(\\VRR44'd V\nRxV\nV\nV\nR# T\nT\nT\ni;i5i)zMark this thread's aux LLM call interrupt-protected (re-entrant-safe). ``cancel_check`` / ``cancel_event`` keep an explicit host hard-cancel path (Event preferred); nested scopes inherit both.rpF cancel_checkN cancel_eventis_set)rqrrpcallablerr)rprrruprev_cancel_checkprev_cancel_events&&& r-aux_interrupt_protectionrs ,h >D 9>4P 9>4P'-$ 1=!.HW\8T-R$S$S1=!.C +/!(1B!.1B!.,0!(1B!.1B!.sBC B0 #C0#CCcTV^8dQhR\\.\3,,/#r()rrr)r,s"r-r.r.s!..8HRW,=#>.r/c\\\RR4RR4p\V4'dV#\\RR4p\V4'dV#R#)zHCapture the current explicit-cancel source on the owning request thread.rNrr)rqrr)rrs r-rrsM W6MxY] ^F -~t DEUOO5--r/cJV^8dQhR\.\3,R\/#)r)rr*)rrrm)r,s"r-r.r. s#"c'1Btr/cv\V!44# \d\PRRR7R#i;i)zGRead a request-thread cancellation source without leaking its failures.z captured aux cancel check failedTexc_infoF)rmrrdebugrs&r-rr s7LN##  7$ Gs "88cZa]tRtRtoRtV3RlRltV3RlRltV3RlRltR tVt R #) _AuxiliaryCancellationDecisionizHAtomically choose explicit cancellation or provider timeout per attempt.c8<V^8dQhRS[.S[3,RR/#)r)source_cancel_checkr*Nrr)r,rQs"r-r.+_AuxiliaryCancellationDecision.__annotate__s$!!HRW,=!$!r/cTWn\P!4VnRVnR#)rpN)_source_cancel_check threadingLock_lock_outcome)r9rs&&r-r\'_AuxiliaryCancellationDecision.__init__s$7!^^%   r/c <V^8dQhRS[/#r(rl)r,rQs"r-r.rs00$0r/cVP;_uu_4VPR8Xd#\VP4'dRVnVPR8HuuRRR4# +'giR#;i)rp cancelledNrrrrrEs&r-r<'_AuxiliaryCancellationDecision.__call__sG ZZZ}}(-KDLeLe-f-f + ==K/ZZZs AA"" A3 c <V^8dQhRS[/#r(rl)r,rQs"r-r.r"s00t0r/c VP;_uu_4VPR8Xd'\VP4pV'dRMRVnVPR8HuuRRR4# +'giR#;i)z@Return whether timeout won and destructive cleanup is permitted.rpr timed_outNr)r9rs& r-begin_timeout_cleanup4_AuxiliaryCancellationDecision.begin_timeout_cleanup"sJ ZZZ}}(:4;T;TU /8 k ==K/ ZZZs AA&& A7 )rrrN) rHrIrJrKrLr\r<rrNrOrPs@r-rrs&R!! 00 00r/rcHV^8dQhR\PR\RR/#)r)locallabelr*N)rrrX)r,s"r-r.r.>s*AAiooAcAdAr/c\VRR4pVfR#V!4R# \d\PRTRR7R#i;i)zHCall the thread-local hook installed on ``local``, if any. Never raises.hookNzaux %s hook failedTr)rqrrr)rrrs&& r- _tick_hookr>sG 5&$ 'D |A  A )54 @As#AAcV^8dQhRR/#rrD)r,s"r-r.r.I**d*r/c&\\R4R#)z1Tick the installed forward-progress hook, if any.progressN)r _aux_progressrDr/r-_notify_aux_progressrI }j)r/cV^8dQhRR/#rrD)r,s"r-r.r.Nrr/c&\\R4R#)zFRecord an actual provider dispatch without claiming response progress.dispatchN)r _aux_dispatchrDr/r-_notify_aux_dispatchrNrr/cV^8dQhRR/#rrD)r,s"r-r.r.Ss<Whether an Anthropic stream event carries a non-empty payload.r+content_block_deltadeltac3N<"TFp\\SV44xK R#5ir8rmr).0fr s& r- /_anthropic_event_has_content..ns"q3pa4ua())3p"%TFcontent_block_start content_blocktool_usec3N<"TFp\\SV44xK R#5ir8r")r#r$blocks& r-r%r&qs#:j[iVW4ua@P;Q;Q[ir')textthinking partial_json signaturecitation)idr`)rany)r event_typer,r s& @@r-_anthropic_event_has_contentr5isv&J**ug&sq3pqssqsqsq3pqqq**uo.eV$ 2jjss:j[i:jssjsjs:j[i:j7jj r/c@V^8dQhR\\.R3,/#rr)r,s"r-r.r.us(C5$;*?r/c\aa\4o\P!4oRVV3RllpV#)aPer-event callback for the Anthropic aux wire: progress only for substantive payloads (keepalives must not keep a stalled summary alive), stop at the host deadline or explicit cancel. The ``TimeoutError`` text must say "timed out" so ``_is_timeout_error`` classifies it.c(V^8dQhR\RR/#)r)rr*Nr)r,s"r-r.6_anthropic_aux_stream_event_hook..__annotate__|s j j j jr/c<\V4'd \4M \4\4'd \ 4hSeG\ P !4S8d+\R\ P !4S, R R24hR#R#)NzLAnthropic auxiliary stream timed out at the host compression deadline after .0fz&s (the caller already stopped waiting))r5rr rrtime monotonic TimeoutError)r host_deadlinestarteds&r- _on_event3_anthropic_aux_stream_event_hook.._on_event|sz ' . . ) + ' ) * , ,/1 1  $)9])J""&.."2W")rBr@rAs @@r- _anthropic_aux_stream_event_hookrEus-12MnnG j j r/N@c8V^8dQhR\P/#)r)r)rr)r,s"r-r.r.s)//r/c#"\VRR4p\V4'dTMTVnRxW nR# Y ni;i5i)zXInstall one thread-local hook, restoring the prior on exit (non-callable = passthrough).rN)rqrr)rrpreviouss&& r-_aux_thread_local_hookrJs8ufd+H!$XEJ  X s(A7A?Ac#"\\V4;_uu_4RxRRR4R# +'giR#;i5i)zZInstall *hook* as the current thread's aux forward-progress callback (None = passthrough).N)rJr)rs&r-aux_progress_hookrLs% t 4 4  5 4 4 4s>* > ; >c:V^8dQhR\\,/#r(rfloat)r,s"r-r.r.s11huo1r/cX\\RR4p\V4'dV!4#T#)z`The waiting host's absolute monotonic deadline, if one is installed (read live from a callable).valueN)rq_aux_stream_deadlinerrQs r-rDrDs& ('4 8Euoo57050r/cpV^8dQhR\\.\R,3,,R,/#)r)deadlineN)rOr)r,s"r-r.r.s+..%(2ut|3C*D"Dt"K.r/c#"\\RR4p\V\\34'g\ V4'dTMT\nRxV\nR# T\ni;i5i)uPublish the host's absolute ``time.monotonic()`` deadline to the stream consumer. ``None`` is a passthrough; re-entrant-safe. Host->worker return leg of the progress hook: without it the isolated provider daemon streams to its own ceiling after the host stopped waiting, billing a summary the commit fence refuses. ``8207862212`` releases the compression OWNER when the fence is cancelled, but the isolated provider daemon (:func:`_run_protected_sync_provider_call`) that holds the socket keeps streaming to its own ``_aux_stream_total_ceiling`` budget — >= the host's ceiling by construction — billing an abandoned summary the commit fence is already guaranteed to refuse, and stacking one fresh orphan per turn on a session that compression never managed to shrink. See #99692. rQN)rqrRr?intrOrrQ)rUrIs& r-aux_stream_deadlinerXsX+Wd;H-73,-O-OS[\dSeSeks. %-"X"sA A0A  A0 A--A0cV^8dQhR\\\\3,.\3,R\\\3,R\/#)r)callbackr;r*)rrrXr)r,s"r-r.r.sD<%<%$sCx.9I39N0O<%Y]^acf^fYg<%lo<%r/c .aaaaaa a a a a \4p\4'd\V4'g S!S4#\V4oS!4'd \ 4h\ \ RR4o \ \RR4o\ \RR4o \ \RR4o \4o \P!4p\P!4o/o RVVVVV VV V V V 3 Rllp\P!VP V3RRR7P#4\%S4'd \ 4hSP'R 4'gK5\%S4'd \ 4hS P)R 4pVeVhS P)R 4#) aRun one protected provider callback in an attempt-isolated daemon thread. Aux clients are process-shared and cannot be closed to wake one request, so the callback (incl. stream aggregation) runs in a daemon while the owner polls cancellation; on cancel the owner unwinds at once and the daemon finishes under the provider timeout in ``kwargs`` (it owns no transcript/commit state, never holds the session lock). Unprotected / no cancel source: direct. rNrQcV^8dQhRR/#rrD)r,s"r-r.7_run_protected_sync_provider_call..__annotate__s  d r/c< \S4;_uu_4\\S4;_uu_4\\S 4;_uu_4\ S4;_uu_4\ S 4;_uu_4\ SR7;_uu_4S!S4SR&RRR4RRR4RRR4RRR4RRR4RRR4SP4R# +'giLJ;i +'giLU;i +'giL`;i +'giLk;i +'giLv;i +'giL;i \dpTSR&Rp?LRp?ii;i SP4i;i)rresultN exception) rLrJrr rXrr BaseExceptionset) excrZr dispatch_hookdoner@r;outcome progress_hookprovider_response_hook reading_hooks r-_provider_worker;_run_protected_sync_provider_call.._provider_workers !-00&}mDD&'=?UVV#M224G 4U4U(lCC$,V$4!D5V2WE1 HHJ DC5V4U22WVED10 '#&GK  ' HHJsED2D D C90C& CC&C9!D )D 1D29E C#C&& C61C99 D D DD  D/ *D22 E =EE"E EEE"EE""E4zhermes-protected-aux-providerT)targetr:r`daemong{Gz?r`r_)rrrrrrqrrr rRr contextvars copy_contextrEventThreadrunstartrwaitr)rZr;rprovider_contextrjr`rrdrer@rfrgrhrisff @@@@@@@@r-!_run_protected_sync_provider_callrvsR45 # % %X6I-J-J22EFL~~+--M648MM648M$%;VTJ0'4@M.0L#//1 ?? D G   ##+;*=DcUW  *, 7 7/1 1yy  ), 7 7/1 1KK ,  O{{8$$r/c<V^8dQhR\R\R\/#)r) client_objflagr*rrXrm)r,s"r-r.r.s!CDr/cR\\WR44# \dR#i;i)uWhether ``client_obj`` (or its class) sets ``flag`` truthy; absent → False. Capability declaration, not isinstance, so out-of-tree clients can opt out of wrappers unimported (cf. SUPPORTS_HERMES_TOOL_CALLS).F)rmrqr)rxrys&&r-_client_declaresr|s+GJe455 s  &&c<V^8dQhR\R\R\/#)r)r@ maybe_typer*r)r,s"r-r.r.s!#34r/c>\W4# \dR#i;i)zDReturn False instead of raising when a patched symbol is not a type.F)r? TypeError)r@r~s&&r-_safe_isinstancers$#** s c$V^8dQhR\/#)r)urlrW)r,s"r-r.r.s3r/c\V4pVP'dZ\VPRR74\ VP4P 4UUu/uFwr#W#^,bK upp3#VR3#uuppi)zNExtract query params from URL, return (clean_url, default_query dict or None).rj)queryN)r rr_replacer items)rparsedkvs& r-_extract_url_query_paramsrsm c]F |||&///348TZT`T`KaKgKgKi6jKi41qA$wKi6jjj 97ksA;ollamacustomvllmllamacppz llama.cppz llama-cppcFV^8dQhR\\\3,/#r(rrX)r,s"r-r.r.%stCH~r/c\fT\\4p\P!\ 4;_uu_4^RIHpVPV4RRR4Vs\# +'giL;i)uyThe same alias table the main provider path resolves against (hermes_cli.auth). A hand-copied mirror here rots silently every time auth grows a family — the local servers (#106010) and the OpenCode entries were both missed that way. Local-server names stay pinned on top: that set doubles as the guard for the /v1 tail and the no-key-borrow rule in the custom branch below. N)_PROVIDER_ALIASES) _ALIAS_TABLEr_LOCAL_SERVER_ALIASES contextlibsuppressrhermes_cli.authrupdate)merged _auth_tables r-_provider_alias_tabler%sP!%&;!<   + + H MM+ &,  , +s A"" A2 cFV^8dQhR\\,R\/#r)providerr*rrX)r,s"r-r.r.6s??hsm??r/cT;'gRP4P4pVPR4'd4VPR^4^,P4pV'gR#TpVR8XdR#VR8XdD\ 4;'gRP4P4pV'dVR9dR#Tp\ 4P W4#) autocustom::rcodex openai-codexmainrj>rr)striplower startswithsplit_read_main_providerrr)r normalizedsuffix main_provs& r-_normalize_aux_providerr6s$$f++-335JY''!!#q)!,224 WV(*00b779??A I)99 " & &z >>r/cFV^8dQhR\\,R\/#r)modelr*r)r,s"r-r.r.Ms<.tsJ5`^C  OOtsSy1OOT__S3Y5OO^sAA!AT)zgpt-5.4zgpt-5.5zgpt-5.6z gpt-6-solz gpt-6.1-solz gpt-6-luna)_codex_route_bare_modelagent.model_metadatarr3)rrrrs&& @r-_is_codex_gpt54_or_gpt55rds #5 3D |=%%$T!! - - ` `5`^5```5`^5`2``r/c~V^8dQhR\\,R\\,R\\,/#rr)r,s"r-r.r.ys3^^8C=^HSM^hWZm^r/cvT;'gRP4P4R8Xd \V4#R#)zQLowercased bare model slug when ``provider`` is the Codex OAuth route, else None.rjrN)rrrrrs&&r-rrys2"*..b!7!7!9!?!?!A^!S;u ]Y]]r/chV^8dQhR\\,R\\,R\/#rr)r,s"r-r.r.~s.MM8C=MHSMMTMr/c\W4R8H#)zYTrue for ``gpt-5.3-codex-spark`` on the Codex OAuth route (the slug exists nowhere else).zgpt-5.3-codex-spark)rrs&&r-_is_codex_sparkr~s "5 37L LLr/cFV^8dQhR\\,R\/#rr)r,s"r-r.r.s"^^x}^^r/cv\V4pVPR4;'dVPR4'*#)zTrue for OpenAI reasoning families that 400 (``unsupported_value``) on any non-default ``temperature``: gpt-5.x (incl. dated snapshots, ``-pro``, ``-codex``), o1/o3/o4. The ``gpt-5-chat`` non-reasoning line still accepts it (#51083).z gpt-5-chat)zgpt-5o1o3o4rrs& r-#_is_openai_default_temperature_onlyrs3 u D ??6 7 ] ]P\@]<]]r/c V^8dQhR\\,R\\,R\\\3,R\RR/#)r)rrVrejected_kwargserrorr*N)rrXrrra)r,s"r-r.r.sLrrsmr'/}rGKCQTH~r^kr rr/cv\P\W4\VP R4434R#)rN)_TEMPERATURE_REJECTED_ROUTESaddrrr)rrVrrs&&&&r-remember_temperature_rejectionrs.!$$j&DkRaReRefmRnFo%pqr/c V^8dQhR\\,R\\,R\\,R\\,\,/#)r)rrVrr*)rrXrOobject)r,s"r-r.r.sA>> C=>$,SM>DLSM> e_v>r/c\V4'd\PRV4\#^RIHp\ V4'gV!\V44'd\PRV4\#\W!4\V43\9d\PRV4\#\V4'dR#R#)z``OMIT_TEMPERATURE`` (drop the key; Kimi/Moonshot, OpenAI reasoning families, Gemini 3.6+, routes that already rejected it), a fixed ``float``, or ``None``.z7Omitting temperature for Kimi model %r (server-managed))gemini_sampling_deprecatedzKOmitting temperature for %r (default-only, or Gemini 3.6+ ignores sampling)z7Omitting temperature for %r (route rejected it earlier)g?N) rrrOMIT_TEMPERATUREagent.gemini_native_adapterrrrrrr)rrVrrs&&& r-_fixed_temperature_for_modelrs e NPUVF*5115OP[\aPb5c5c bdij8& E(:;?[[ NPUV,U333==r/allow_codex_gpt55_autoraisec V^8dQhR\\,R\\,R\R\\,/#)r)rrrr*)rrXrmrO)r,s"r-r.r.s: C=$,SM!%e_r/c\V4'dR#V'd\W4'd\#\W4'd\#R#)u"Per-model/route compression threshold override (fraction of context used), or None. Arcee Trinity Large Thinking → 0.75 (preserve reasoning context); Codex-route gpt-5.4/5.5/5.6/Astra → 0.85, gated by ``allow_codex_gpt55_autoraise``; Codex-route gpt-5.3-codex-spark → 0.70, ungated. g?N)rr'_CODEX_GPT54_GPT55_COMPACTION_THRESHOLDr!_CODEX_SPARK_COMPACTION_THRESHOLD)rrrs&&$r- _compression_threshold_for_modelrs:"%(("'?'P'P66u''00 r/gemini-3.6-flashreasonrc0V^8dQhR\R\/#)r)model_idr*rXtuple)r,s"r-r.r.s^^^^r/c  \;QJd@.R\\P!RVP 4444FNK 5#!R\\P!RVP 44444#)zSort key putting a family's newest release first: digit runs compare numerically (plain string order picks ``gpt-3.5-mini`` over ``gpt-5.4-mini`` and breaks at 9 vs 10).c3~"TF3wrV'gKV^,'d^\V4R3M^RV3xK5 R#5i)r)rjNrO)r#indexparts& r-r%%_model_recency_key..s=^TKEX\ > E$K3~=Ts ===z(\d+(?:\.\d+)?))r enumeratererr)rs&r-_model_recency_keyrsm 5^$RXX.@(..BR%ST^5^5^$RXX.@(..BR%ST^ ^^r/c0V^8dQhR\R\/#)r) provider_idr*rW)r,s"r-r.r.s::#:#:r/c XaVP4P4R8Hp^RIHp^RIHp^RIHpRRreV!V4;'g/p\VPRR44P4p\VPRR44P4pV'gV'd^R IH pV!4wrVV'g'\\V!V4RR4;'gR4pVPR 4pV'gR#VP!R4p/p V'd ^RIHp RR RV /p T!RRT;'gRRVRR/V B;'g/p \%RT 4\&R R7p T'd^RIHp HpT!Y!44p \,FspT FjpTP4oTS9gK\.;QJd#T3Rl\04F 'gK R M RM!T3Rl\044'dKfTuu# Ku R# \d\PRTR R 7ELi;i \d\PR R R 7ELi;i \d\PRTR R 7R#i;i \d\PRR R 7EL!i;i)zNewest ``_FAST_MODEL_FAMILIES`` match from the provider's live (cached) catalog. "" when the catalog is unavailable or holds no small model (caller falls through to the curated default). Never raises; the fetch is memory+disk cached. nous)$resolve_api_key_provider_credentials)fetch_models_with_pricingget_provider_profilerjrUrVzNo credentials for %s catalogTr)!_resolve_nous_pricing_credentialszNo Nous credentials for catalogr/v1)_NOUS_CATALOG_TTL_SECONDSinclude_sale_originalcache_ttl_secondsNtimeoutg@z'Fast-model catalog lookup failed for %sc38"TFp\V4xK R#5ir8rW)r#ms& r-r%+_fast_model_from_catalog..s*'Q#a&&')rreversenous_policy_allowed_idsrestrict_to_nous_policyzNous policy filter unavailablec3,<"TF qS9xK R#5ir8rD)r#xlowereds& r-r%r s,WCVa'\CVFrD)rrrrhermes_cli.models_pricingr  providersr rXrrrrr rqrstrip removesuffixrsortedrrr_FAST_MODEL_FAMILIESr3_FAST_MODEL_EXCLUDE)ris_nousrr r rUrVcredsr  _nous_kwargsrcatalogidsrrfamilyrrs& @r-_fast_model_from_catalogr+su !'')V3G%HG2 V8EKKE%))Ir2399;G599Z45;;=H7 OW$E$G!7#7 #DjRTU[[\H??3'((/  K3T;NPijL+UOOtU.6U@CUGSU[[XZ  *'*0BD QC J b)#/F/HIC'Hnn&G ,WCV,W,WCV,W)W)W' Q V LL8+PTL U V O > N O  > VZ [ J LL9DL I JsIH AHI&I/H0>II%II"I;I I2J#H-)I,H--I0"IIII#J?J"J)(J) prefer_fastc<V^8dQhR\R\R\/#)r)rr,r*rXrm)r,s"r-r.r.s"!!S!$!SV!r/cRp\P!\4;_uu_4^RIHpV!V4pRRR4RpV'd3\ V4pV'g VeVP 4;'gRpV'g#VeVP'd VPpV'g\PVR4pV'dPVP4P4R8Xd-^RIHpHpV!4pV'dV!V.V4'gR#V#V# +'giL;i \d\PRTRR7Li;i \d\PR RR7T#i;i) a*Cheap auxiliary model for a provider. Ladder: (``prefer_fast`` only) live-catalog family match, then ``ProviderProfile.resolve_aux_model``; then ``default_aux_model`` (curated); then the legacy dict. ``prefer_fast`` is opt-in (titling) so other callers keep their static behaviour and cache keys. Nr rjzresolve_aux_model failed for %sTrrrzNous policy check unavailable)rrrrr r+resolve_aux_modelrrdefault_aux_model%_API_KEY_PROVIDER_AUX_MODELS_FALLBACKrrrrrr)rr,profiler pickedrralloweds&$ r-_get_aux_model_for_providerr6s?G   Y ' '2&{3 (F)+6'- \ 224:: g)g.G.G.G** 6::;K+##%++-7 I b-/G6xII M6M3 ( ' \ > VZ [ \ I LL84L H M Is;DD,5D,,EE D) ,#EE"E;:E;geminizaiz glm-4.5-flash kimi-codingzkimi-k2-turbo-previewstepfunzstep-3.5-flashzkimi-coding-cngmiz$google/gemini-3.1-flash-lite-preview anthropicclaude-haiku-4-5-20251001z ai-gatewayzgoogle/gemini-3-flashz opencode-zenzgemini-3-flashz opencode-gozglm-5kilocodezgoogle/gemini-3.6-flashz ollama-cloudznemotron-3-nano:30bztencent-tokenhubz hy4-previewztencent-tokenplantitle_generationcFV^8dQhR\\,R\/#r)taskr*r)r,s"r-r.r.Is"RR8C=RTRr/cnV\9;'d&\\V4PR4RR7#)zHReturn whether an eligible task explicitly opts into fast-model routing.prefer_fast_modelFr)_FAST_MODEL_TASKSr_get_auxiliary_task_configrrBs&r-_task_prefers_fast_modelrIIs; $ $ R R"4(,,-@A5*RRr/xiaomiz mimo-v2.5z glm-5.3-flashcFV^8dQhR\R\\,/#rrXr)r,s"r-r.r.Ws  s x} r/c\PV4pV'dV#^RIHpV!V4pVeVP 4#R# \ dR#i;i)zProvider default vision model id, or None: static ``_PROVIDER_VISION_MODELS`` (vision-only names absent from any catalog) win, else ``ProviderProfile.default_vision_model()``.r N)_PROVIDER_VISION_MODELSrrr default_vision_modelr)rstaticr r3s& r- _resolve_provider_vision_defaultrQWsY% ( ( 2F  2&x0181Dw++-N$N s!AA AAz HTTP-Refererz%https://hermes-agent.nousresearch.comzX-Titlez Hermes AgentzX-OpenRouter-Categorieszproductivity,cli-agentcLV^8dQhR\R,R\R,/#)r)headersNr*r)r,s"r-r.r.qs"r/c ^RIHpHpV!4pV!VRR4pV!VRR4p\V\4'd'V'd/\V\4'dTM/CVCp\T\4'd T'gT#\ T;'g/4pTP TP4UUu/uF wrxTfK \T4\T4bK" upp4T;'gT# \ dTu#i;iuuppi)a%Merge user ``model.default_headers`` onto resolved headers (user wins; ``model.extra_headers`` alias wins over both). Mirrors ``AIAgent._apply_user_default_headers`` so a custom endpoint behind a WAF rejecting ``User-Agent`` / ``X-Stainless-*`` works for aux calls. SECURITY: never log values.cfg_get load_configrdefault_headers extra_headers) rrWrXr?rrrrrX) rSrWrX_cfg user_headers alias_headersrrrs & r-_apply_user_default_headersr^qs:}tW.?@ g? mT * *}hz,/M/M|SUhZghL lD ) ) '--R F MMl.@.@.BT.Bdaa>3q63q6>.BTU   W  Us$AC.C.4D D . C>=C>c>V^8dQhR\R,R\/#)r) or_configNr*rT)r,s"r-r.r.st tr/c\\4pVf^RIHpV!4P R/4p\ PP RR4P4P4pV'd VR9gV#VP RR4'gV#RVR&\ PP R R4P4pV'dLVP4'd4^\V4u;8:dR 8:dMV#\\V44VR &V#VP R R 4p\V\\34'd+^Tu;8:dR 8:dMV#\\V44VR &V# \ d/pELXi;i)a$OpenRouter headers, plus response-cache headers when enabled. Precedence env > config > default: ``HERMES_OPENROUTER_CACHE`` overrides ``openrouter.response_cache``; ``HERMES_OPENROUTER_CACHE_TTL`` (1-86400 s) overrides ``openrouter.response_cache_ttl``. ``or_config=None`` reads from disk. r openrouterHERMES_OPENROUTER_CACHErjtrueresponse_cacheFzX-OpenRouter-CacheHERMES_OPENROUTER_CACHE_TTLiQzX-OpenRouter-Cache-TTLresponse_cache_ttli,>1onyesre)r_OR_HEADERS_BASErrrrosenvironrrisdigitrWrXr?rO)r`rSr env_cacheenv_ttlttls& r-build_or_headersrssY#$G  >,.22<DI 8"=CCEKKMI7@I3 3GPmmTdfkFlFl$*G !jjnn:B?EEGG ??  c'l!;e!; N 14CL0AG, - Nmm0#6 cC< ( (Q#->-> N14CH G, - N I sE:: F  F zX-BILLING-INVOKE-ORIGIN HermesAgentc>V^8dQhR\R,R\/#)r)rVNr*)rXr)r,s"r-r.r.s"}}sTz}d}r/cn\\T;'gR4R4'd\\4#/#)zIReturn NVIDIA NIM cloud attribution headers for build.nvidia.com traffic.rjintegrate.api.nvidia.com)rrXr_NVIDIA_NIM_CLOUD_HEADERSrVs&r-build_nvidia_nim_headersrzs-.CCTVDWYs.t.t4) *|z||r/)get_version_info User-Agentz HermesAgent/)nous_portal_tagsc$V^8dQhR\/#r(rT)r,s"r-r.r.s))$)r/cR\4/#)zTFresh Nous Portal ``extra_body`` (per call, so a hot-reloaded version is reflected).tags)_nous_portal_tagsrDr/r-_nous_extra_bodyrs %' ((r/z&nvidia/nemotron-3-ultra-550b-a55b:freez)https://inference-api.nousresearch.com/v1zhttps://api.anthropic.comz auth.jsoncF^RIHp\\8wd\#V!4#)aActive profile's ``auth.json`` at call time (a patched ``_AUTH_JSON_PATH`` still wins). The import-time constant is the LAUNCH profile's; under multiplexing a secondary's auxiliary calls would otherwise authenticate to Nous with the default profile's token._auth_file_path)rr_AUTH_JSON_PATH_AUTH_JSON_PATH_AT_IMPORTrs r-_auth_json_pathrs0-1JJ?aP_Paar/c0V^8dQhR\R\/#r)rr*r.)r,s"r-r.r.sZZZZr/ca\V4P;'gRP4o\;QJd#T3Rl\ 4F 'gK RM RM!T3Rl\ 44;'gC\;QJd#T3Rl\ 4F 'gK R# R#!T3Rl\ 44# \dR#i;i)zGTrue when the URL's host is a known dual-surface (MiniMax-family) host.rjFc3n<"TF*pSV8H;'gSPRV,4xK, R#5i)rN)endswith)r#rhosts& r-r%2_is_dual_surface_anthropic_host..s1Di&55$--f 55Dis5!5Tc3F<"TFpSPV4xK R#5ir8r)r#prefixrs& r-r%rs Y3XT__V $ $3X!)r hostnamer ValueErrorr3%_DUAL_SURFACE_ANTHROPIC_HOST_SUFFIXES%_DUAL_SURFACE_ANTHROPIC_HOST_PREFIXES)rrs&@r-_is_dual_surface_anthropic_hostrs &&,,"335 3Di333Di  Z Z  Y3X YZ Z Y3X Y YZ sB<B<< C  C c0V^8dQhR\R\/#rrW)r,s"r-r.r.s##r/c\T;'gR4P4PR4p\V4R8Xd^RIHpV!V4#VP R4'd\VR4'g\VR4'd/VR\R4)R ,p\PR W4V#\V4'd/VR\R4)R ,p\PR W4V#\PR V4V#\VR4'd9VP R4'd"VR ,p\PRW4V#V#)uANormalize dual-surface Anthropic URLs to their OpenAI-compatible sibling. MiniMax-family: ``/anthropic`` → ``/v1``; ZAI Coding Plan → ``/coding/paas/v4`` (the general endpoint bills separately); Kimi Code ``/coding`` → ``/coding/v1`` (the OpenAI SDK path 404s without it). Anthropic-only gateways keep their path. rjrzapi.actual.incnormalize_actual_base_url /anthropiczopen.bigmodel.cnzapi.z.aiNz/coding/paas/v4u0Auxiliary client: rewrote ZAI base URL %s → %sr u9Auxiliary client: rewrote dual-surface base URL %s → %szQAuxiliary client: keeping Anthropic-only base URL %s (no dual-surface host match) api.kimi.com/codingu1Auxiliary client: rewrote Kimi base URL %s → %s) rXrr rrrrrlenrrr)rVrr rewrittens& r-_to_openai_base_urlrs1 hnn"  # # % , ,S 1C!11=(-- ||L!! &8 9 9=RSVXb=c=c0s<0014EEI LLKS \  *3 / /0s<001E9I LLTVY e  _ad f S.11cll96M6M%K  H#Y Jr/rjcRV^8dQhR\R\R\\,/#)r)rnoter*rXrr)r,s"r-r.r.s%==#=S=(3-=r/c\V4pT'dTP 4'dT#R# \d#p\PRYT4Rp?R#Rp?ii;i)zJ``load_pool(provider)`` when it has credentials, else None (never raises).z2Auxiliary client: could not load pool for %s%s: %sN)rwrrrhas_credentials)rrpoolrcs&& r-_load_pool_with_credentialsrsU"D00224<<  I8[^_s / AAAchV^8dQhR\R\\\\,3,/#r)rXrrmrr)r,s"r-r.r. s(   tXc]/B)C r/c\V4pVfR#RVP43# \d#p\P RY4RuRp?#Rp?ii;i)z2Return (pool_exists_for_provider, selected_entry).NTz8Auxiliary client: could not select pool entry for %s: %sFNTN)rselectrrr)rrrcs& r-_select_pool_entryr sS &x 0D |T[[]""  OQY_s% AA A AcRV^8dQhR\R\R\\,/#)r)rrr*)rXrr)r,s"r-r.r.s%s##r/c8Vf \VR4pVfR#\VRR4p\V4'dV!4MRpVeV#\VRR4p\V4'dV!4#R# \d"p\P RY4Rp?R#Rp?ii;i)zBest-effort current/next pool entry without mutating selection order. ``pool`` skips the disk re-read when the caller already loaded it. N (peek)currentpeekz6Auxiliary client: could not peek pool entry for %s: %s)rrqrrrr)rr current_fnrpeek_fnrcs&& r-_peek_pool_entryrs  |*8Y? | ^T9d3 "*:"6"6*,D  N$- G  9    ^ Mx]] ^s,A-$A-- B8BBc0V^8dQhR\R\/#r)entryr*r)r,s"r-r.r..s""""r/c\VRR4;'g\VRR4p\T;'gR4P4#)runtime_api_keyNrrj)rqrXr)rrs& r-_pool_runtime_api_keyr.s< %*D 1 W WWUNTV5WC syyb>   !!r/c<V^8dQhR\R\R\/#)r)rfallbackr*r)r,s"r-r.r.4s! . .# . .c .r/cVf3\T;'gR4P4PR4#\VRR4R8Xd^RIHpV!4pV'dV#\VRR4;'g-\VRR4;'g\VRR4;'gTp\T;'gR4P4PR4#) Nrjrrr)_nous_inference_env_overrideruntime_base_urlinference_base_urlrV)rXrr rqrr)rrrenv_urlrs&& r-_pool_runtime_base_urlr4s }8>>r"((*11#66uj$'61@.0 N 5,d 3 ; ;wuFZ\`7a ; ;eZ. ; ;2: syyb>   ! ( ( --r/api.anthropic.comc0V^8dQhR\R\/#rr.)r,s"r-r.r.Hs  s t r/cV'gR#\V4pVP;'gRP4P4P R4\ 9dR#VP ;'gRP R4P4pVPR4;'gVPR4# \dR#i;i)a True for native Anthropic hosts and gateways serving Messages under a ``/anthropic`` path (same convention as runtime_provider / ``_wrap_if_needed``), so a configured ``model.base_url`` whose gateway holds auth is not discarded. A bare non-Anthropic base_url is False.FrjrTrr /anthropic/v1) r rrrr _ANTHROPIC_COMPATIBLE_HOSTSpathrr)rrrs& r-_is_anthropic_compatible_hostrHs # OO ! !r ( ( * 0 0 2 9 9# >B] ] !!r))#.446}}\*LLdmmO.LL s(C7C#C67C.C CCc$V^8dQhR\/#r(rW)r,s"r-r.r.Xs3r/c \^<\\P!RR444# \\ 3dR#i;i)<HERMES_NOUS_MIN_KEY_TTL_SECONDS1800i)maxrWrmgetenvrrrDr/r-_nous_min_key_ttl_secondsrXs<2s299%FOPQQ z "s),AAc0V^8dQhR\R\/#r_rW)r,s"r-r.r._s//#/#/r/cV'gR#^RIHpHpV!V4;'gRP4# Td2\P !T4;'gRP4u#i;i)aiRead a provider API key (or its paired base-URL) env var through the profile secret scope. In agent turns the scope's verdict is authoritative (a scoped miss must not borrow another profile's key); only the unscoped default-profile path (``UnscopedSecretError``) reads ``os.environ`` -- any other scope failure propagates instead of borrowing the ambient env. rj)UnscopedSecretError get_secret)agent.secret_scoperrrrmr)r`rrs& r-_scoped_key_envr_s\ B/4 &&B--// / $%%2,,../s44#A,A,+A,c0V^8dQhR\R\/#)r)streamr*r9)r,s"r-r.r.psWW3W3Wr/c^RIHp\\VRR4RR4p\V\4'dVP R4MRpVe V!V4#R#)zThe raw socket under an SDK event stream (``stream.response`` is the ``httpx.Response``; httpcore publishes its connection as the ``network_stream`` extension), or None.)_socket_from_streamresponseN extensionsnetwork_stream)agent.agent_runtime_helpersrrqr?rr)rrrrs& r-_attempt_stream_socketrpsU@T:L$OJ9CJPT9U9UZ^^$45[_N2@2L ~ .VRVVr/cJV^8dQhR\R\\,RR/#)r)rl failure_noter*NrrrX)r,s"r-r.r.ys*QQ3QhsmQQr/c\VRR4p\V4'd V!4R#R# \d(T'd\P RTRR7R#R#i;i)zhCall ``target.close()`` if present; a failure is debug-logged under ``failure_note`` (silent when None).closeNzCodex auxiliary: %sTr)rqrrrr)rlrrs&& r-_close_quietlyrysW FGT *E Q G Q 2L4 P Qs+AAAzstream stalledc6a]tRtRtoRtR#V3RlRlltV3RlRltV3RlR ltV3R lR ltV3R lR lt V3RlRlt V3RlRlt V3RlRlt V3RlRlt V3RlRltV3RlRltV3RlRltV3RlRltV3RlRltV3R lR!ltR"tVtR#)$_CodexStreamGuardiaProgress-aware deadline + FD-safe timeout watchdog for one Codex aux stream attempt. (1) The first substantive payload must arrive within ``no_progress_timeout`` or we fail fast into the caller's retry/fallback chain (a dead or keepalive-only zombie must not hold the budget); (2) each substantive event re-arms that window (keepalive/lifecycle frames do NOT, mirroring commit-fence gating) so a live stream is never killed by an absolute total; (3) a hard ceiling from ``_aux_stream_total_ceiling`` still terminates a pathological drip. NcL<V^8dQhRS[RS[S[,RS[S[,/#)r)r total_timeoutno_progress_timeoutrrrO)r,rQs"r-r._CodexStreamGuard.__annotate__s-202020*25/20%e_20r/cWnW n\P!4Vn\ V\ \34'dV^8d\V4VnM \VnVe%\VP\V44VnVP\V4,Vn \4p\ V\ \34'd!W@P8d\V4Vn \P!4VnVPVP,Vn\P$!4Vn\P$!4Vn\P$!4Vn\P$!4VnRVn\14'd \34MRVn\P!4VnRVn\P:!4VnR#N)_clientrr=r>_startr?rWrOr'_AUX_STREAM_NO_PROGRESS_TIMEOUT_SECONDSmin_aux_stream_total_ceiling hard_deadlinerDrr_deadline_lock_progress_deadlinerp saw_contentrtimeout_release_pendingstream_finished_timerrr_protected_cancel_check_attempt_stream_lock_attempt_stream get_ident _owner_tid)r9rrrr@s&&&& r-r\_CodexStreamGuard.__init__sh *nn&  )C< 8 8=PST=T',-@'AD $'ND $  $'*4+C+CU=EY'ZD $![[+D]+SS56 mc5\ 2 2}GYGY7Y!&}!5D 'nn."&++0H0H"H$??,"*(1'8$(0 G_F`F`'@'Bfj$$-NN$4!$(#--/r/c <V^8dQhRS[/#r(r)r,rQs"r-r.rsDDEDr/cVP;_uu_4\VPVP4uuRRR4# +'giR#;ir8)rrrrrEs&r-effective_deadline$_CodexStreamGuard.effective_deadlines3  t))4+B+BC! s A A c <V^8dQhRS[/#r(rl)r,rQs"r-r.rsII$Ir/c VVPp\V4;'d \V4#)zITrue when the frozen hard-cancel source says the owner already cancelled.)rrr)r9rs& r-cancel_requested"_CodexStreamGuard.cancel_requesteds%,,HH#A%#HHr/c$<V^8dQhRS[RR/#r)rr*Nr9)r,rQs"r-r.rs**3*4*r/ctVP;_uu_4WnRRR4R# +'giR#;ir8)rrr9rs&&r- adopt_stream_CodexStreamGuard.adopt_streams#  & & &#) ' & & &s& 7 c$<V^8dQhRS[RR/#rr9)r,rQs"r-r.rs((S(T(r/c \VR4VP;_uu_4RVnRRR4R# +'giR#;i)z     DOO 3)&1DH &v,' &s B B c<V^8dQhRR/#rrD)r,rQs"r-r.rsRRRr/c VP;_uu_4\P!4VP,VnRRR4R# +'giR#;i)zQSubstantive payload re-arms the no-progress window; the hard ceiling never moves.N)rr=r>rrrEs&r-record_progress!_CodexStreamGuard.record_progresss7  &*nn&69Q9Q&QD #! s ,A  A c <V^8dQhRS[/#r(rW)r,rQs"r-r.rs T T Tr/c\P!4VP, p\P!4VP8d#RVPVP, R R2#VPP 4'gR\ VP4R RVR R2#R\ R\ VP4R RVR R2#) z*Codex auxiliary Responses stream exceeded z.1fzs hard ceilingz;Codex auxiliary Responses stream produced no output within zs (no-progress timeout, z s elapsed)zCodex auxiliary Responses z: no new output for zs () r=r>rrrrrOrCODEX_STREAM_STALL_MARKER)r9elapseds& r-timeout_message!_CodexStreamGuard.timeout_messages.."T[[0 >> t11 1?@R@RUYU`U`@`ad?eest t&&(( 8 89#>>VW^_bVccmo p))B(CD11237s73-z S Tr/c<V^8dQhRR/#rrD)r,rQs"r-r.rs0]0]$0]r/c\VPRR4p\V4'd\V!44pMVP 4'*pVP P 4V'gVPR4R#VPP 4\P!4VP8Xd\VPR4M@^RIHpV!VP4p\ P#RV4VPR 4\)VP4R# \$d\ P'RRR7LMi;i \$d\ P'R RR7R#i;i) rNz4cancelled attempt stream close during timeout failedz"client close during timeout failed)force_close_tcp_socketsz]Codex auxiliary client aborted (timeout, tcp_force_closed=%d, deferred_close=stranger_thread)z3Codex auxiliary: client abort during timeout failedTrz:attempt stream close during stranger-thread timeout failedz1Codex auxiliary: cache eviction on timeout failed)rqrrrmr rrbrrrrrrrrr*rinforr_evict_cached_client_instance)r9r timeout_wonr*shutdown_counts& r-_close_client_on_timeout*_CodexStreamGuard._close_client_on_timeouts? '(D(DF]_c d ) * *467K"3355K   % %&\ ]  $$((*    DOO 3 4<<)M N cO!8!F 67EG  % %&b c ] *$,, 7 c R]a b c ] LLLW[L \ ]s$.D1E1"EE"E?>E?c<V^8dQhRR/#rrD)r,rQs"r-r.r,sr/cVPer\P!4VP48dJVPP 4'gVP 4\VP44h^RI H p\4'd \4hV!4'd\4'g \R4hR#R# \dh\dR#i;i)N)is_interruptedz,Codex auxiliary Responses stream interrupted)rr=r>rrrr/r?r&tools.interruptr3rrrInterruptedErrorr)r9r3s& r-check_cancelled!_CodexStreamGuard.check_cancelled,s    )dnn.>$BYBYB[.[>>((**--/t3356 6  6/00355(@(B(B&'UVV)C     s,C .C C'"C'&C'c<V^8dQhRR/#rrD)r,rQs"r-r.rAs(((r/c.VP4\P!4, pV^8dTVPP 4'g2VP P 4'gVP V4R#VP4R#r)rr=r>rrr _arm_timerr/)r9 remainings& r-_watchdog_fire _CodexStreamGuard._watchdog_fireAsg++-0@@ q=NN))++t/C/C/J/J/L/L *  %%'r/c$<V^8dQhRS[RR/#)r)delayr*Nr)r,rQs"r-r.rKs$r/c\P!WP4;VnpRVnVP 4R#r)rTimerr<rrmrs)r9r?ts&& r-r:_CodexStreamGuard._arm_timerKs-#//%1D1DEE a  r/c<V^8dQhRR/#rrD)r,rQs"r-r.rPstr/c VP'dDVP\VP4\P !4, R44VP 4R#)zNArm the watchdog (when a total timeout exists) and run the first cancel check.rN)rr:rrr=r>r6rEs&r-rs_CodexStreamGuard.startPsB     OOC 7 7 9DNN[+[+d38n[+tCQTH~WZ\_G_A`[+r/c   ^RIHpHpHpHpHpHp^RIHpVPRVP4p V!V 4p \\VPRR4;'gR4p \V R4p V!\RV R74p V P pV P"pVPR 4pV'd>^RIp^R IHpHpVP-\/V44pV!V4wppV!V4wppT!V!V4R \VPR R4;'gRRV /V4wppVP74UUu/uF wppVVbK pppRp.pVPR.4EFpVPR4;'gRpVPRR4R8Xd&\9V\4'dTM \V4pK[V'dVPR4'd/VCRVR,Uu.uFtp\9V\:4'dZVPR4;'g/PR4V9d+/VCR/VR,CRVVR,R,,/C/CMTNKv up/CpVP=V4EK V!R8RV /V P?4Bp V!VV V V RR7p!RT RTRT!;'g V!RR4.RR/p"VPR4p#V#eV#V"R&\9VPR4\:4'd%VR,'d\;VR,4V"R&VPR4;'g/p$\9V$\:4'EdV$PR4p%\9V%\4'd2V%PA4'dV'gV%PA4V"R&V$PR 4p&\9V&\:4'd^R!I!H"p'^R"IH#p(V(!WV PHR#7p)V)'dHV&PR$4RJd3T'!V&PR%4;'gR&V)4p*R%V*R'R(/V"R &R).V"R*&MR+V)9dV'gR%R+/V"R &V'dVV"R &V'dVV"R,&T V"R-&^R.IH%p+H&p,^R/IH'p-V'gaV'gYR0V"9dRT+!\QR14;'g \QR244p.V,!V"R,V"PR 4V.4p/V/'dV/V"R0&R3V"9dV-!W4p0V0'dV0V"R3&^R7IH*p1T1!T"Y4T"T T#3# \0d"p\2P5R T4Rp?ELVRp?ii;iuuppiuupi \0d\2PSR4R5R67Lri;i)9utchat.completions kwargs → Responses API kwargs, ``(resp_kwargs, model, timeout)``; mirrors codex.py::build_kwargs.)!_chat_messages_to_responses_input_classify_responses_issuer_responses_tools_role_message_item_wire_model_identityclassify_responses_route)_alias_wire_toolsrrVrjgithubcopilot.comNrrVtools)strip_pattern_and_formatstrip_slash_enumzRAuxiliary client: failed to sanitize tool schemas for Codex/xAI Responses path: %sr_hermes_aux_effective_providerzYou are a helpful assistant.messagescontentroleusersystem tool_callsfunctionr`F)is_github_responsescurrent_issuer_kindcurrent_issuer_modelnative_compaction_eligible instructionsinputstorerrZ extra_body service_tier reasoning) clamp_effort)_codex_efforts_for_route)is_codex_backendenabledeffortmediumsummaryrzreasoning.encrypted_contentincludenone _wire_aliases _issuer_kind)_cache_scope_from_session_id_content_cache_key)+_default_prompt_cache_retention_for_requestprompt_cache_key cache_scope session_idprompt_cache_retentionz4Codex auxiliary: prompt_cache_key derivation skippedTr)_sanitize_astra_request_kwargsrD)+agent.codex_responses_adapterr`rarbrcrdreagent.transports.codexrfrrZrXrqrrris_xai_responsesrtcopytools.schema_sanitizerrjrkdeepcopylistrrrrr?rappend_asdictragent.reasoning_effortr~rrrrr_runtime_main_valuerr)2r9r;r`rarbrcrdrerfr wire_modelr is_copilotrouteis_xai is_githubri_copyrjrk_rc wire_tools wire_aliasesaliasoriginalrenamedrxreplay_messagesmsgrntc issuer_kind input_items resp_kwargsrr{r| reasoning_cfgr~r supportedrrrrscope cache_keycache_retentionrs2&& r-_build_responses_kwargs0_CodexCompletionsAdapter._build_responses_kwargsvsB   = 7DKK0)%0 74<<R8>>B?*41DE ($QU)VW''--  7#  $]tE{33E:q+E2q$5 U # /OQST\\X\^hjn o $  L ;G:L:L:NO:Nuh8U?:NO6 02::j"-Cggi(..BGwwvv&(2*4Wc*B*BwG 377<00l",/-0""d++ 1C1I1Ir0N0Nv0VZa0adrc:'b"Z.'b&'"Z.Y_J`Ba'bcgij/-  " "3 '.(1R$R%--/R 7  +!+  Z [DD%7%C$Dgu' **Y'  %,K " fjj14 8 8VO=T=T+/0G+HK (ZZ -33 j$ ' '%>>.9L,,,1C1C1E1Ef.:.@.@.B N+&NN;7M-.. @K4USXSiSij !2!29!=U!J)-*;*;H*E*Q*QS\]F08&)V/TK ,.K-LK *y(08&/AK , #-K +7K (&1 N#  ` ` Zi-?{-R4' 6[[:Ml:[/{>/JKOO\cLdfkl 6?K 23'{:"Me"Z"P@V9gK VVP>P@,VP>n KN T PM4\ORRPQT4PS4;'gRT;'gRR7p\O^TTR7p\OT.TTR7# T P7T4i;i \BdWpT P*P-4'd\ET PG44Th\HPKRT4hRp?ii;i T PM4i;i)ris_actual_routerlrjrVzFActual requests require Chat Completions; refusing to call /responses.rNrrr)r)_consume_codex_event_stream)bypass_sdk_request_transformrTz*late cancelled attempt stream close failedoutput)rrJz@Codex auxiliary Responses stream did not return a final response)_parse_codex_final_response)r issuer_modelz-Codex auxiliary Responses API call failed: %s assistant)rornrrrmessage finish_reasonchoicesrusagerD)*hermes_cli.providersrrqrrXrrpoprr?rWrOrrsagent.codex_runtimeragent.sdk_transform_bypassr responsescreaterrrr rhasattrrJrrcagent.auxiliary_codex_responserrsr`rr?r&rrrOrjoinr)r9r;rrrrrrrrguardrr stream_kwargs event_streamfinalr text_partstool_calls_rawrrrrcrchoices&, r-r_CodexCompletionsAdapter.creates8  DLL"BB G  j"5;; <  X  '+&B&B6&J# G"=CC !oond; ;??73<>E$$\2}"#eff R?Z\@ H\_HdhHr/cb\V\4'gR#VPR4pVR8Xd;VPR4p\V\4'dRV9dR#VR,pMVR8XdRR/pMR#VPR4p\V\4'g/pWPR&RRRV/VR&R#) zAMerge an OpenAI response format into Anthropic ``output_config``.Nr+ json_schemaschema json_objectr output_configr,)r?rr)rr format_typer r rs&& r-$_translate_anthropic_response_formatrs ot , ,!%%f-Km#%))-8 +t,, 0K X&  %(#$((9M mT * * ,9)%}hGM(r/cLa]tRtRtoRtR V3RlRlltV3RlRltRtVtR#) _AnthropicCompletionsAdapterizrrrequired>r}r)agent.anthropic_adapterrr agent.transportsr!rrZrr?rrXrrrr*rrrrrrEnormalize_responserrrqrrnrrr}r)r9r;rr r!rr#r%r_eb_rcr' choice_typerr*top_level_response_formatcaller_extra_bodyrr passthroughexistingr_nrrr1r2rs&, r-r#_AnthropicCompletionsAdapter.creates\2 7DKK0 ::,e 4 4JL1XXVZZ@W5XJjj/  #67  **\*C*4S$*?*?#''+&TC#t$$ # jj/ k4 ( (koofb9:@@BKj()ooj"=AA&I -8>B1)1 _ -%+JJ/@$A! $ 0 01A ]"JJ|4 ,=t!D!D 01ACTCXCXYjCk l!2!8!8!:!:A<<EHVEVEVWZE[1!: +// =CC!(D11!H1LH1L 1L .+ LL DXCYCY=?_c  01DDXaeaoaoDp 8W % %(...#HNNNAFKK!M ' K P Pq #+?P$X^^^QGnnM\mLmE !#CKKCNN^a^k^kl++  xuEJJAs< Q< Q</Q<)rrrrZrrrPs@r-rrs F 3 3^K^Kr/rc@a]tRtRtoRtRV3RlRlltRtRtVtR#) AnthropicAuxiliaryClientiz@OpenAI-client-compatible wrapper over a native Anthropic client.c 8<V^8dQhRS[RS[RS[RS[RS[/#)r)rUrrUrVrrz)r,rQs"r-r.%AnthropicAuxiliaryClient.__annotate__s1!!C!!c!S!\`!r/c `Wn\\WWTR74VnW0nW@nR#))rrVN)rrrrrUrV)r9rUrrUrVrs&&&&&&r-r\!AnthropicAuxiliaryClient.__init__s'':;X`tu   r/ch\VPRR4p\V4'd V!4R#R#)rN)rqrr)r9close_fns& r-rAnthropicAuxiliaryClient.close$s+4,,gt< H   J r/rNFrrPs@r-rArAsJ!! r/rAc]tRtRtRtR#)AsyncAnthropicAuxiliaryClienti*rDNrrDr/r-rKrK*rr/rKcHa]tRtRtoRtV3RlRltV3RlRltRtVtR#) _BedrockCompletionsAdapteri.zGTranslates ``chat.completions.create(**kwargs)`` into Bedrock Converse.c&<V^8dQhRS[RS[/#r)regionrrW)r,rQs"r-r.'_BedrockCompletionsAdapter.__annotate__1ss3r/cWnW nR#r8)_regionrZr9rPrs&&&r-r\#_BedrockCompletionsAdapter.__init__1s   r/c <V^8dQhRS[/#r(r9)r,rQs"r-r.rQ5s#r/c ^RIHpVPRVP4pVPR4;'gVPR4pVPR4p\ V\ 4'dV.pVPR4e&\ PRVPR44VPR 4'd\ PR V4T!VPY1PR .4VPR 4V'd \V4MRVPR 4VPR4VR7p\4V#)r) call_converserr#r$stopr'NuVBedrockAuxiliaryClient: tool_choice=%r not supported by the Converse shim — ignored.ruBedrockAuxiliaryClient: stream=True requested for %s — returning a complete response (Converse shim does not stream); caller downgrades to non-streaming.rmrir%top_p)rPrrmrir#r%rZstop_sequences) agent.bedrock_adapterrXrrZr?rXrrrSrWr)r9r;rXrr#rYrs&, r-r!_BedrockCompletionsAdapter.create5s7 7DKK0ZZ -TT6C'>#C$#C$' D2D DDc:V^8dQhR\\,/#r()rr)r,s"r-r.r.s$r/c\R4wrV'dvVfR#R\VRR4R\VRR4R\VRR4R\V\4R\VRR4R \VR R4R \VR R4R \VR R 4R R/ #\ 4pVP 4'gR#\ P!VPRR74pVPR4R8wdR#VPR/4PR/4pVPR4'gVPR4'gR#V# \d"p\PRT4Rp?R#Rp?ii;i)zkNous provider state dict from the credential pool or ~/.hermes/auth.json; None when not active with tokens.rNrrj refresh_token agent_keyrportal_base_url client_idr token_typeBearersourcerz utf-8-sig)encodingactive_providerrzCould not read Nous auth: %s) rrqr_NOUS_DEFAULT_BASE_URLris_filejsonloads read_textrrrr) pool_presentr auth_pathdatarrcs r-_read_nous_authrsN,V4L = GE>2> WUOTB  T: "8@V"W wu.?F  T: WUGT2 '%x@ f  #%   ""zz)--{-CD 88% && 088K,00<||K((n1M1M  3S9s0 E.E E, E''E,c0V^8dQhR\R\/#rr)r,s"r-r.r.s  D S r/c ^RIHpRFvwr#VPV4p\V\4'dVP 4'gKDV!W@PR4VPV4R7'gKtVu# R#)z;Extract a usable Nous inference JWT from stored auth state.)_nous_invoke_jwt_is_usabler)r expires_atrj))r{agent_key_expires_at)rr)rrrr?rXr)rr token_key expiry_keytokens& r- _nous_api_keyrsh:!h  Y'%%%U[[]]  %e<<3HU]UaUablUm n nL "i r/ force_refreshchV^8dQhR\R\\\\3,,/#)r)rr*)rmrrrX)r,s"r-r.r.s*##T#huUXZ]U]F_#r/c^RIHp\R4pT'dTP 4'gR#TP4pTfR#RRlpT'gT!T!T4\44'gTP4pTfR#Tp\T!T44p\T\4pT'd T'gR#Yx3# \d"p\P RT4Rp?R#Rp?ii;i \d"p\P RT4Rp?R#Rp?ii;i \d#p\P RT4RpRp?LRp?ii;i) z@Resolve Nous auxiliary credentials from the selected pool entry.)_agent_key_is_usablerz4Auxiliary Nous pool credential resolution failed: %sNz(Auxiliary Nous pool selection failed: %scRV^8dQhR\R\\\3,/#)r)er*rrrX)r,s"r-r.4_resolve_nous_pool_runtime_api..__annotate__s&YYYS#XYr/c DRUu/uFq\WR4bK up#uupi)r{N)r{rrrrrq)rrs& r- _entry_state4_resolve_nous_pool_runtime_api.._entry_states;1XY1X171&&1XY YYsz&Auxiliary Nous pool refresh failed: %s) rrrwrrrrrrtry_refresh_currentrrr) rrrrcrr refreshedrUrVs $ r-_resolve_nous_pool_runtime_apirs!8  t++--  }Y0e1DF_Fabb 002I  L/0G%e-CDH (  =  KSQ  ?E  LLA3 GI sFCC36D" C0C++C03 D>DD" E-E  Estale_access_tokenc V^8dQhR\R\\,R\\\\3,,/#)r)rrr*)rmrrXr)r,s"r-r.r.s58@  eCHor/c\VR7pVeV#^RIHpT!\R^4TT;'gRR7p\ 4\T4# \dp\ T4Rp?R#Rp?ii;i)u$Fresh Nous runtime credentials (pool first, then auth store + JWT refresh) — mirrors the main agent's 401 recovery. ``stale_access_token`` is the bearer that just 401'd; with ``force_refresh`` it lets the auth store adopt a sibling process's rotation instead of re-POSTing the shared grant.rN resolve_nous_runtime_credentialsHERMES_NOUS_TIMEOUT_SECONDS)timeout_secondsrr)rrrrrrr _creds_pair)rrpooledrr&rcs$$ r-_resolve_nous_runtime_apirsv ,- HF   D0%&CRH'199T "# u   's+ sAA A/ A**A/cV^8dQhR\\\3,R\\\\3,,/#r)r&r*rrXrrr)r,s"r-r.r.s/tCH~(5c?*Cr/c\VPR4;'gR4P4p\VPR4;'gR4P4PR4pV'd V'gR#W3#)zX``(api_key, base_url)`` from a runtime-credentials dict, or None when either is missing.rUrjrVrN)rXrrr )r&rUrVs& r-rrsf%))I&,,"-335G599Z(..B/557>>sCH (  r/c\V^8dQhR\\\\3,,/#r()rrrX)r,s"r-r.r.s  HU38_$= r/c ^RIHpHp\R4pV'dVP 4'dVP 4pVe\ \VRR4;'g\VRR4;'gR4P4pRpT!V!\R44;'gHV!\R 44;'g/V!\VR R44;'gV!\VR R44VR 7pV'd V'dWF3#^RIH pT!4p \T 4# \d!p\PR T4Rp?L?Rp?ii;i \d"p\PRT4Rp?R#Rp?ii;i)zFresh xAI OAuth (api_key, base_url) for aux clients, or None. Pool first (some xAI OAuth logins exist only as pool entries), then the singleton auth-store resolver. )DEFAULT_XAI_OAUTH_BASE_URL _xai_validate_inference_base_url xai-oauthNrrrjcf\T;'gR4P4PR4#)rjr)rXrr )rs&r-,_resolve_xai_oauth_for_aux..*s"QWW"!3!3!5!?@>>ON;<>>GE+=tDE>>GE:t<=7 x",,I57 u  W PRUVVW  SUXYs^0D!,D! D!51D!'D!D!!D!=D!D! E! E ,EE  E;E66E;c\V^8dQhR\\\,\3,/#r(rrrX)r,s"r-r.r.?s$JJE(3-2D,EJr/c\4p\R4wrV'd7\V4pV'd$V'dW03#^RIHpW4!\ V443#\ 4T;'g\3#)af``(token, base_url)`` taken from ONE authority, so a Codex key is only ever sent to the host it belongs to (#121486): the profile-scoped ``HERMES_CODEX_BASE_URL`` wins; otherwise a pooled key goes where that pool entry routes (row URL / ``model.base_url``) and the auth.json OAuth token goes to the ChatGPT default. ``(None, )`` without a usable token.r)_codex_pool_route_base_url)_codex_base_url_overriderrhermes_cli.auth_codexrr_read_codex_singleton_token_CODEX_AUX_BASE_URL)overriderrrrs r-"_resolve_codex_credential_and_baser?se ()H,^<L%e, & H45KE5RSS S & ((*I*I6I IIr/c:V^8dQhR\\,/#r(r)r,s"r-r.r.RsXc]r/c^RIHpV!4PR/4PR4p\V\4'dVP 4'gR#^RIpVPR4^,pVR\V4)^,,, p\P!VPV44PR^4pV'd3\P!4V8d\PRV4R#TP 4# \dLi;i \d"p\PR T4Rp?R#Rp?ii;i) zMThe profile's auth.json Codex access token (expired JWTs skipped), else None.)_read_codex_tokenstokensrNr=expz-Codex access token expired (exp=%s), skippingz2Could not read Codex auth for auxiliary client: %s)rrrr?rXrbase64rrrrurlsafe_b64decoder=rrr)rrrpayloadrrcs r-rrRs6)+//"=AA.Q ,,,L4F4F4H4H  "((-a0G ss7|ma/0 0G**V55g>?CCE1MCtyy{S( LcR!!##     I3Os=AD*B*D D* D'$D*&D''D** E5EEcrV^8dQhR\\\,\\,3,/#r(rrr&rX)r,s"r-r.r.js)II5&)98C=)H#IIr/c^RIHpHpTP 4EFwr#TPR8wdK\T4'd\P RT4KBTR8XdX\P!\4;_uu_4^RIH pT!R4'g RRR4KRRR4\4u#TR8XdL\P!\4;_uu_4^RIH pT!R4'g RRR4KRRR4\T4;'gRpTfEK\T4wrgT'dC\T4pT'gEK9\!YsP"4;'g TP"p R p MT!T4p \%T P'RR 44P)4pT'gEK\%T P'R R 44P)4P+R 4;'g TP"p R p \-R4p T P'R 4T8XdoT P'R 4'dXT R ,P+R 4p \/T P'R4\$4'dT R,'d T R,pRp \P RTP0YZ4\3T 4p TR8Xd$^RIHpHpT!T 4'dT!YR7T3u#\;T R4'dRR/pMI\;T R4'd^RIHpT!4pM)\;T R4'd \AT 4pM \CT4pT'dRT/M/p\ETP'R44pT'dTTR&\GRRTR T /TBp\ITYXT 4T3u# R# \d\P R4Ru#i;i +'giEL2;i +'giEL;i)zVTry each API-key provider in PROVIDER_REGISTRY order; (client, model) or (None, None).)PROVIDER_REGISTRYrz7Could not import PROVIDER_REGISTRY for API-key fallbackNrUz2Auxiliary api-key chain: %s is unhealthy, skippingr<)!is_provider_explicitly_configuredcopilotz via poolrjrVrrz (session endpoint)z Auxiliary text client: %s (%s)%sr7GeminiNativeClientis_native_gemini_base_urlr[rr|claude-code/0.1.0rg)copilot_default_headersrwrYNNrD)%rrrrrrr auth_type_is_provider_unhealthyrrr_try_anthropicr6rrrrrXrrr _normalize_main_runtimer?r`rrrrrhermes_cli.modelsrrz_profile_default_headersr^rrw)rrrpconfigrrrrrU raw_base_urlviar&runtimerVrrrSrextrarrs r-_resolve_api_key_providerrjsD[!2 7 7 9    )  !+ . . LLM{ [  + %$$[11M8EE21E2"# # ) #$$[11M8CC21C2,K8@@D = 0= +E2G1%9S9STrrX_XrXrLC8EE%))Ir2399;GuyyR89??AHHMkkQXQkQkLC*$/ ;;z "k 1gkk*6M6M":.55c:L'++i0#6679;M;M!),'C 7uR&|4 ( " a(22)'MuTT > : :#%89G "8-@ A A A-/G "8-G H H.x8G.{;G07"G,R,UYY7H-IJ '-E# $&SwSSUS$VU\JEQQC!:D K  NO211211s)N'O#O#'"O  O  O # O4 is_visionxaic jV^8dQhR\R\R\R\R\\,/#)r)rVrrrr*)rXrmrr)r,s"r-r.r.s?@@@ @04@CG@ d^@r/c\VR4'dRR/pM\VR4'd^RIHp\V!RVR74pMm\VR4'd\\ V44pMFV'd*\VR 4'd^R IHp\V!44pM\V4;'g/p\T;'gR 4;'gR #) aJProvider-specific client headers by endpoint host, merged with user ``model.default_headers``. Kimi Code needs the claude-code User-Agent; Copilot needs its request headers (``is_vision`` adds Copilot-Vision-Request); NVIDIA NIM and (optionally) xAI have their own fingerprints; anything else falls back to the provider profile. rr|rrg)copilot_request_headersT) is_agent_turnrrwzx.aihermes_xai_default_headersN) rhermes_cli.copilot_authrrrztools.xai_httprrr^)rVrrrrSrrs&&$$ r-_endpoint_default_headersrsX~66%':; x)< = =C.TYWX x)C D D/9: &x88=134*84:: &w$ 7 ? ?4?r/cFV^8dQhR\R\\,/#r)rXrr)r,s"r-r.r.s  s x~ r/c&V'gR#\P!\4;_uu_4^RIHpV!V4pV'd2VP 'd \ VP 4uuRRR4#RRR4R# +'giR#;i)zZClient-level attribution headers from the provider profile (e.g. GMI User-Agent), or None.Nr )rrrrr rYrrr r3s& r-rrs`    Y ' '2&x0 w...//0 ( ' '  ( ' s(A?A?? B cFV^8dQhR\\,R\/#rr)r,s"r-r.r.s"MM(3-MDMr/cV'gR#\V4P4pVPR4;'gVPR4#)uhTrue when ``model`` is a free SKU (``:free`` suffix or ``stealth/`` prefix) — naming-convention trust.F:freezstealth/)rXrrr)rrs& r-_is_free_modelrs> U!!#J   w ' L L:+@+@+LLr/cFV^8dQhR\\\3,/#r()rrmrX)r,s"r-r.r.s ( (%c "2 (r/c ^RIHpHpV!4p\V!VRRRR74pV!VRR4p\ V\ 4'd'VP 4'dVP 4M\pW53# \d R\3u#i;i)zVRead (free_only, openrouter_model) from config; (False, _OPENROUTER_MODEL) on failure.)rWr auxiliary free_onlyFrEopenrouter_model) rrWrrmr?rXr_OPENROUTER_MODELr)rWrcfgrrrs r-_aux_openrouter_settingsrs~(C"$k;NO c;(:;)#s33  IZ ('''(sAA5A55B  B c(V^8dQhR\RR/#)r)rr*NrW)r,s"r-r.r.s    r/cvV\9dR#\PV4\PRV4R#)zDLog a WARNING the first time a non-free OpenRouter model is engaged.NuAuxiliary client: PAID lane engaged for auxiliary task — OpenRouter fallback model %r is not a :free SKU and may incur real spend. Set auxiliary.free_only: true to restrict auxiliary fallbacks to free models, or auxiliary.openrouter_model to a :free model.)_paid_lane_warnedrrrrs&r-_warn_paid_lane_oncer s1 !!%  NN TUZr/c V^8dQhR\\\.\3,,,R\R,R\\,R\\\,\\,3,/#)r)explicit_api_keyrNexplicit_base_urlr*)rrXrrr&)r,s"r-r.r. s^$$hsXb#g5F/F&G$WZ]aWa$'/}$@EhvFVX`adXeFe@f$r/cR\4wr4T;'gTpV'd*\V4'g\PRV4R #\V4'g \ V4T;'gRP 4P R4p\R4wrxV'dT;'g \V4p V 'dUT;'g\V\4;'g\p \PR4\W\4R7V3#\PR4T;'g \R4p V 'g)\R^<\!V4\"P$R7R #\PR 4\Y;'g\\4R7V3#) u Auxiliary client: auxiliary.free_only is enabled but the OpenRouter fallback model %r is not a :free SKU — skipping the OpenRouter fallback. Set auxiliary.openrouter_model to a :free model (e.g. nvidia/nemotron-3-ultra-550b-a55b:free) or disable auxiliary.free_only.rjrrcz%Auxiliary client: OpenRouter via poolrUrVrYzFAuxiliary client: OpenRouter pool exhausted, trying OPENROUTER_API_KEYOPENROUTER_API_KEYrrrlevelzAuxiliary client: OpenRouterr)rrrrr rr rrrrrrrsr_mark_provider_unhealthy _describe_openrouter_unavailableloggingDEBUG) r rr r cfg_modelor_model override_urlrror_keyrVs &&& r-_try_openrouterr sj35I!! H11 h    ( # #X&&++224;;C@L,\:L!AA%:5%A #pp'=eEX'Ypp]pH LL@ A(CSCU   ]^  F F1E!FF  b)I()S[b[h[h j LL/0 !D!D1DVfVh  r/c>V^8dQhR\R,R\/#)r)rNr*rW)r,s"r-r.r.' s44C$J4#4r/c\4wrT;'gTpV'd\V4'gRV: R2#\R4wrEV'dVfR#\V4'gR#\ R4'gR#R#) zBReturn the policy or credential reason OpenRouter was unavailable.z,auxiliary.free_only rejected non-free model z=; the request was skipped before provider availability checksrczOOpenRouter credential pool has no usable entries (credentials may be exhausted)z=OpenRouter credential pool entry is missing a runtime API keyrzOPENROUTER_API_KEY not setz&no usable OpenRouter credentials found)rrrrr)rrrrrrs& r-rr' sz35I!! H11:8,GJ J -\:L =d$U++R / 0 0+ 3r/c~V^8dQhR\R\\\,\\,3,/#)r)visionr*)rmrrr&rX)r,s"r-r.r.; s5DLDLdDLuXf-=x}-L'MDLr/c \4p\RR7pVf=V'g5\PR4\ R^;HDH g SUXZeffgsB C#CCrcHV^8dQhR\R\R\R\/#)r)fieldreadonlyrr*r.)r,s"r-r.r. s(Cd4Cr/c|\V4p\V\4'dAVP4'd+VP4pV'dVP 4#T#\ P !\4;_uu_4^RIH pV'd VPM VP!4pVPR/4pVR8XdG\V\4'd1VP4'dVP4uuRRR4#\V\4'd|TPVR8XdRMTR4p\V\4'dKVP4'd5VP4pV'dVP 4MTuuRRR4#RRR4R# +'giR#;i)a*Main ``model.``: runtime override (``set_runtime_main``) first, then config.yaml. The override wins so "active main model" gates see the live CLI/gateway runtime, not the persisted default. ``readonly`` picks ``load_config_readonly`` (model/provider) vs ``load_config`` (api_key/base_url). rrNrrj)rr?rXrrrrr hermes_clirrrXrr)r8r9rrrQ_cfg_modr model_cfgs&$$ r-_read_main_fieldr> s, #5)H(C  X^^%5%5  %u{{}050   Y ' '108x,,h>R>RRUGGGR( G  9c : :y?P?P??$ ( ' i & &MMu/?)UBOE%%%%++-- (-u{{}5 ( ' '  ( ' s&A0F*5F*AF*,F*F** F; r)r9r)r9rrUrVcV^8dQhR\\,R\\\,\\,3,/#)r) preset_namer*)rrXr)r,s"r-r.r. s3#5#PXY\P]A];^r/c$^RIHp^RIHpT!V!4P R4;'g/T;'gR4pVP R4;'g/p\ VP R4;'gR4P 4p\ VP R4;'gR4P 4pV'd!V'dVP4R8wdWV3#R # \d\PR TR R 7R #i;i) uMoA preset → aggregator (provider, model); (None, None) if unresolvable. None/"" = default preset. "moa" is virtual — aux tasks skip the fan-out and use the aggregator slot; shared so lookup can't drift. rX)resolve_moa_presetmoaN aggregatorrrjrz.MoA aggregator resolution failed for preset %rTrr) rrXhermes_cli.moa_configrCrrXrrrrr)r@rXrCpresetagg agg_provider agg_models& r-_resolve_moa_aggregatorrK s c1<#KM$5$5e$<$B$BKDWDWSWXjj&,,"377:.44"5;;= (..B/557 I,*<*<*>%*G* *  c E{]a b cs9*C( C(C(C(71C()C(C(C((#DDc$V^8dQhR\/#r(rW)r,s"r-r.r. s#r/c\4p\4;'gRP4P4R8Xd\ V4wrT;'gR#V#)zpMain model with MoA presets unwrapped to the aggregator's model; "" when unresolvable (a preset name would 400).rjrD)_read_main_modelrrrrK)rrrJs r-_read_main_model_for_auxrO sL  E##**,224=.u5 B Lr/c`V^8dQhR\R\\.\3,,/#)r) aux_base_urlr*)rXr)r,s"r-r.r. s(  C C(2s7BS.wrapped s* "4 0 0T,V,1 0 0 0s( 9  functoolswrapsrZrlsf r-_relay_auxiliary_callrr s%__X-- Nr/cFa\P!S4V3Rl4pV#)z3Async counterpart to :func:`_relay_auxiliary_call`.c<"\W4;_uu_4S!V/VBGRjxL uuRRR4#L +'giR#;i5ir8rjrks*,r-rl,_relay_auxiliary_call_async..wrapped s7 "4 0 0!426221 021 0 0s$A 424 A4 A Arnrqsf r-_relay_auxiliary_call_asyncrv s%__X33 Nr/cjV^8dQhR\R,R\R,R\R,RR/#)r)rNrror*rW)r,s"r-r.r. s8>>t>C$J>RUX\R\>ae>r/c\P4pVfR#\T;'gR4VR&\T;'gR4VR&RVR&\T;'gR4VR&R#)Nrrr\rr_r`ro)rarrX)rrrocontexts&&& r-_set_relay_auxiliary_routerz si%))+Gh55+6GJ5--I.GG $G h<<*<=GJr/cV^8dQhR\\\\3,,R\\,R\\,RR/#)r) route_inforrr*NrrrX)r,s"r-r.r.* sB11c3h(142BC2G)H4)O$ $r/caaa a a aaaa^RIHpHoV!SS4o\P 4;'g/pVP R4oT;'gVP R4VR&T;'gVV3Rlo \ W#R7pVf \ S S4#Twopo ^RIHo^R I H p \SP R 4;'gT4o T !V VV V VVV3R l\S P R 4;'gR 4S SSSS \S P R4;'gR 4R7# \dp \T 4hRp ? ii;i)rprepare_chat_messagesrelay_chat_metadatarBrstream_providerc<\SVS4#r8)_create_with_progress)requestrrBs&r-r(_relay_sync_completion..T s*?QU*Vr/rroN relay_llmrun_with_aux_hooksrc F<SPSV3RlSSS!S4RR7#)c<\SV4#r8)rv)rrZs&r-r:_relay_sync_completion....a s(I(T[(\r/Tr`rmetadatadefer_logical_completion)execute_currentrZr;rrrrrsr-rr` s,I--\"zDWX`Da)-.r/rrjroaux_taskrrr;rrro)agent.auxiliary_wirerrrarrrvagentragent.auxiliary_hooksrrXr_note_relay_auxiliary_error)rr;rrorr relay_contextrfallback_modelrrcrZrrrrrrBsff$$$ @@@@@@@r-_relay_sync_completionrF s1P "66 2F ,//177RM   V $D'/'P'P=3D3DZ3PM#$WWVH %x KE }06BB.3+M>88VZZ(::N;J !   &67==2>Z`io"*s8<2BC2G)H4)O r/caaa a a a aa"^RIHpHoV!SS4oT;'gV3Rlo \W#R7pVfS !S4GRjxL #Two po ^RIHo^RIHp\SPR4;'gT4o T!V VV V V VV3Rl\S PR 4;'gR 4S SSS S \S PR 4;'gR 4R 7GRjxL #LL \dp \T 4hRp ? ii;i5i) rrc<\SV4#r8_acreate_with_progressrrs&r-r)_relay_async_completion..u s *@*Qr/rNr)arun_with_aux_hooksrc ><SPSSSSS!S4RR7#)Tr)execute_current_asyncrsr-rr s)I33},X6QU4r/rrjror) rrrrrrrrrXrrr)rr;rrorrrrrrcrZrrrrrsff$$$ @@@@@@r-_relay_async_completionrm sP "66 2FRRQH %x KE }f%%%.3+M>89VZZ(::N;J (  &67==2>Z`io"*s8<. s'V[[44;;q>_`gio>pqr/rrrrc J<SPSSSS\S!S4RR7#)c\VR4#)r)rrSs&r-r6_relay_sync_stream.... s_fglnw_xr/)r`r finalizerrcompleted_response_predicate)stream_currentr)rr;rrrrrsr-rr s, (( F:QU(2Qx) r/rrjroT)rrrr;rrro streaming) rrrrrrrrrXr)rr;rrorrrrrrrrrrsff$$ @@@@@@r-_relay_sync_streamr sP "66 2FrF %x KE }f~.3+M>88VZZ(::N;J   X\\"2399r:XV\ekj3x||J?W?]?][];^jn  r/cBV^8dQhR\\R3,RR/#)r)values.r*N)rr)r,s"r-r.r. s"66%S/6d6r/c\;_uu_4Vwssssss\V4sRRR4R# +'giR#;i)z[Write the legacy globals + compat snapshot (``_MAIN_RUNTIME_FIELDS`` order) under the lock.N) _RUNTIME_MAIN_COMPAT_LOCK_RUNTIME_MAIN_PROVIDER_RUNTIME_MAIN_MODEL_RUNTIME_MAIN_BASE_URL_RUNTIME_MAIN_API_KEY_RUNTIME_MAIN_API_MODE_RUNTIME_MAIN_AUTH_MODEr_RUNTIME_MAIN_COMPAT_SNAPSHOTrs&r-_publish_runtime_main_mirrorsr s> # "SY Q !46L  68O(-f % # " " "s. ? c\V^8dQhR\\\\3,,/#r(rrrXr)r,s"r-r.r. s 3 3htCH~6 3r/c\P!4\P!4JdR#\\\ \ \\3pV\8XdR#\\\V44#)zExpose deliberately patched legacy globals as a main context. Mirrors must never become runtime inputs: a direct patch counts only when it differs from the mirrored snapshot and only on the main thread. N) rcurrent_thread main_threadrrrrrrrrzip_MAIN_RUNTIME_FIELDSrs r-_compat_runtime_mainr sZ !)>)>)@@$&9;Q#%;=TVF .. (&1 22r/c0V^8dQhR\R\/#)r)r8r*ra)r,s"r-r.r. sKKsKsKr/c\P4pVf \4p\V\4'dVPV4;'gR#R#)zERead one runtime field through context-local/controlled legacy state.rj)_RUNTIME_MAIN_CONTEXTrrr?r)r8rs& r-rr sE#'')G&()3GT)B)BGKK  $ $"JJr/requested_provider auth_moderrcV^8dQhR\R\R\R\R\R\R\R\R \R \P/ #) r)rrrrVrUrorrrr*)rXrrnToken)r,s"r-r.r. sf69JM !$69LO r/ca RT;'gRP4P4RT;'gRP4P4RT;'gRP4RT;'gRP4R\V4RT;'gRP4RT;'gRP4P4R T;'gRP4R T;'gRP4/ o \P S 4p \ \ ;QJd!.V 3R l\4FNK 54V #!V 3R l\444V #) u7Record the current context's live main runtime for auxiliary routing. Context-local so concurrent gateway sessions don't clobber each other; legacy mirrors are updated for old readers. ``cache_scope`` is the rotation-stable logical cache scope, preferred over ``session_id`` for prompt_cache_key derivation. ``cache_scope`` is the rotation-stable logical cache scope (compression- lineage root — agent/prompt_cache_scope.py) resolved once per turn by turn_context; auxiliary Responses calls prefer it over ``session_id`` for prompt_cache_key derivation (#79017). rrjrrrVrUrorrrc36<"TFpSV,xK R#5ir8rD)r#r8rs& r-r%#set_runtime_main.. s'YDX5DXs)rr_normalize_api_keyrrbrrr) rrrrVrUrorrrrrs &&$$$$$$$ @r-set_runtime_mainr s X^^**,224177R>>@FFH%++2$$&X^^**,%g.X^^**,ioo2,,.446z''R..0 ))r002 G " % %g .E!%%'YDX'Y%Z L#('YDX'Y"YZ Lr/c<V^8dQhR\PRR/#)r)rr*N)rnr)r,s"r-r.r. s   k// D r/cnVfR#\PV4R# \\3dR#i;i)z:Restore the runtime binding that preceded one scoped turn.N)rrfrcr)rs&r-reset_runtime_mainr s4 } ##E* * %   s 44c\V^8dQhR\\\\3,,/#)r) main_runtimer)r,s"r-r.r. s ++htCH~&>+r/c#"\V4p\PT;'gR4pVx\PV4R# \PT4i;i5i)zETemporarily bind an explicit runtime without touching legacy mirrors.N)rrrbrf)rrrs& r-scoped_runtime_mainr sN&l3G ! % %goo 6E+ ##E*##E*s+A#A A# A  A#cV^8dQhRR/#rrD)r,s"r-r.r. s< gt $ $%&78??D # #{IGW7XY++j)KY'J++j)K k3 ' '{/@/@/B/B##%,,S1K[/:: j# & &j.>.>.@.@& k3 ' '{/@/@/B/B ((*K 77=    JCP  MsSs/E""F7)FF7 F7F7F22F7c$V^8dQhR\/#r(rW)r,s"r-r.r., s#r/c6\4wppT;'gR#rj)r)rrs r-_current_custom_base_urlr, s/1KA   "r/cV^8dQhRR/#rrD)r,s"r-r.r.1 s$r/c l^RIHp\4RFvp\\P P V4;'gR4P4pV'gKMV!V4pVP'dVPpKvKx R# \dp\RT RT: R24ThRp?ii;i)zFail fast on malformed proxy env URLs (a shell typo like ``:6153export`` otherwise surfaces as a cryptic httpx ``Invalid port``).r rjz%Malformed proxy environment variable rz1. Fix or unset your proxy settings and try again.N) HTTPS_PROXY HTTP_PROXY ALL_PROXY https_proxy http_proxy all_proxy) urllib.parser rrXrmrnrrschemeportrrc)r rrQrrrcs r-_validate_proxy_env_urlsr1 s%cBJJNN3'--2.446  e_F}}}KK d 7uAeYGBB  s!B; B B3B..B3c(V^8dQhR\RR/#)r)rVr*NrW)r,s"r-r.r.D sr/c2^RIHp\T;'gR4P4pV'dVP R4'dR#V!V4pVP R9dVP pR#R# \dp\RT: R24ThRp?ii;i)zEReject obviously broken custom endpoint URLs before they reach httpx.rrjzacp://NzMalformed custom endpoint URL: zJ. Run `hermes setup` or `hermes model` and enter a valid http(s) base URL.>httphttps) r r rXrrrrrrc)rVr rrrrcs& r-_validate_base_urlrD s%HNN#))+I  ,,X66)$ ==- - A . -i];W W  s %A55 BBBcrV^8dQhR\\\,\\,3,/#r()rrrrX)r,s"r-r.r.U s(#g#geHSM8C=$@A#gr/c \4p\V4^8Xd.VORN5MTwrpV'd V'gR#VP4P\P!44'dR#\ 4;'gRp\ PRYC;'gR4\V4wrVV'dRV/M/p\R4pV'dWR&VR8Xd\RRVR V/VBp \W4V3#VR 8Xd,^R I H p ^R IHp V !W!4p \%YY!T !Y4R7T3#\RRVR V/VBp \'WW!V4V3# \ d*\ P#R 4\RRTR T/TBT3u#i;i)r)N gpt-4o-miniz3Auxiliary client: custom endpoint (%s, api_mode=%s)r` default_queryrYcodex_responsesrUrVr,rranthropic_route_is_oauthu|Custom endpoint declares api_mode=anthropic_messages but the anthropic SDK is not installed — falling back to OpenAI-wire.rvrrD)rrrrrrOrrrr^rrr4rsagent.anthropic_credentialsrrrrArw) rrrrr _clean_base_dq_extra_custom_headersrUrsr_fallback_clients r-_try_custom_endpointr#U s%'G?B7|q?P+;W+;d+;V](K[ j%%&9&?&?&ABB $ & 7 7-E LLFOpOp^pq0=K'*os #F1$7O$3 !''+_J__X^_ #K7>>** d F L0IK( J1I+1bdejk k-`Z`+`Y_` !1*S^ _af ff d NNR )\\k\U[\^cc c  dsE 1F?Fc~V^8dQhR\R\\\,\\,3,/#rrXrrr)r,s"r-r.r.{ s,;;s;uXc]HSM5Q/R;r/cV'g\PR4R#\4pVfR#Twr#\PRV4^RIHp\ W#V!4R7p\WP4V3#)uCodexAuxiliaryClient for xAI Grok OAuth (Responses API); (None, None) if not authed. Caller must pass an explicit model — a pinned Grok default would rot as xAI's allowlist drifts. zuAuxiliary client: xai-oauth requested without a model; pass model explicitly (auxiliary..model in config.yaml).z2Auxiliary client: xAI OAuth (%s via Responses API)rrr)rrrrrrrr)rresolvedrUrVrrUs& r-_build_xai_oauth_aux_clientr({ st  M )+H G LLEuM9'.model in config.yaml).z4Auxiliary client: Codex OAuth (%s via Responses API)ryrr)rrrrr_codex_cloudflare_headersr)r codex_tokenrVrUs& r-_build_codex_clientr0 sk  M >@K  LLGO'1+QK 3U ::r/r r c V^8dQhR\\,R\\,R\\,R\\,R\\\,\\,3,/#)r)rr r ror*rrXrr)r,s"r-r.r. sX66sm66>sm6}67?}6 8C=(3- '(6r/cN^RIHp^RIHp^RIHpT!4p\T\4'dTPR4M/p\T\4'g/pT!RTYTR7p T PR 4p \T PR R 4;'gR 4p T;'gT PR 4;'gRp \T 4'g T 'd T 'gR#\T;'g%\TPR4;'gR 4R4pT'g(\PRYPR44R#\!T 4wppT'dRT/M/p\#RR T R T/TBpT R8Xd\%TT4T3#T R8Xd\'TYY4T3#TT3# \ dRu#i;i \d/pELoi;i Td#p \PRT 4RuRp ? #Rp ? i\d#p \PR T 4RuRp ? #Rp ? ii;i)zAzure Foundry aux client via the main agent's ``_resolve_azure_foundry_runtime`` (api_key vs Entra callable bearer, per-model api_mode, base_url overrides). Returns ``(client, model)`` or ``(None, None)``.)_resolve_azure_foundry_runtimerrbNr azure-foundry)rr=r r  target_modelzAuxiliary azure-foundry: %sz)Auxiliary azure-foundry runtime error: %srUrVrjror`rzAAuxiliary azure-foundry: no model resolved (model=%r, default=%r)rrr,rrD)rr4rrrrrr?rrrrrrXr_normalize_resolved_modelrrrrw)rr r ror4rrrr=rrcrUrVruntime_api_mode final_modelrrrrs$$$$ r-_try_azure_foundryr: s N-:"$(23(=(=CGGG$2 )T**I 0.)- kk)$G7;;z2.44"5HPP7;;z#:PP>P W  +E,X,XSy9Q9W9WUW5XZijK  O ==+ 0:K69_c2rE " R7 R[ RE RF,,#FK8+EE//$V[8^`kkk ; Y     2C8  @#FsYF)AF< G) F98F9< G  G H$G4.H$4 H$H$HH$H$c V^8dQhR\\\.\3,,,R\\,R\\\,\\,3,/#)r)r r r*)rrXrrr)r,s"r-r.r. sT7c7cXcHRW4E.E%F7c&.sm7c?DXc]T\]`TaEa?b7cr/c^RIHp^RIHp\ R4wrET'dTeT;'g \ T4pMRpT;'gT!4pT'gR#T'd\T\4M\p\P!\4;_uu_4^RI H pT!4p T PR4p \T \ 4'd\#T PR4;'gR4P%4P'4p T R8XdTT PR 4;'gRP%4P)R 4p T 'd\+T 4'dT pRRR4T;'gRP%4P)R 4p T 'd,\+T 4'g\,P/R T 4R#T p^R IHpT!T4p\3R4;'gR p\54'd\7RTR7T3#\,P9RTY4T!Yg4p\;TTYgTR7T3# \dRu#i;i +'giL;i \dRu#i;i)rrr)resolve_anthropic_tokenNr<rbrrrjrVruAuxiliary client: refusing anthropic explicit base_url %r — not an Anthropic-compatible host; no client built and no request sent.)_is_oauth_tokenr=r[z8Auxiliary client: Anthropic native (%s) at %s (oauth=%s)rvr)r4rsrr=rrrr_ANTHROPIC_DEFAULT_BASE_URLrrrrrrr?rrXrrr rrrr>r6rsrSrrA)r r rsr=rrrrVrrr= cfg_provider cfg_base_urlrr>rrrUs&& r-rr sBG-[9L) @@$9%$@ ==$;$= NZ%e-HI_zH   Y ' ':"$GGG$ i & &y}}Z8>>B?EEGMMOL{* ) j 9 ? ?RFFHOOPST $A,$O$O+H (&++224;;C@L,\:: NNR   ;u%H ' 4 S S8SE"2A5HH LLKUT\g,U=  $KRZ []b bbe  ( 'D sC IAI,AI.'II'I& II I# & I65I6cV^8dQhR\\\\3,,R\\\3,/#)r)rr*r)r,s"r-r.r.' s0(4S>*BtCQTH~r/c6Vf#\P4pVf \4p\V\4'g/#/p\ FpVPV4pVR8Xd.\ V4'd\V\4'gW1V&KH\V\4'gK`VP4'gKxVP4W&K RF>pVPV4p\V\4'gK,VP4W&K@ V#)uReturn a sanitized copy of a live main-runtime override. ``api_key`` may be a zero-arg callable (Entra ID token provider, accepted by the OpenAI SDK) — preserved as-is so aux clients share main-agent auth. rU)rr) rrrr?r_MAIN_RUNTIME_CONTEXT_FIELDSrrXrr)rrr8rQidentity_fieldidentitys& r-rr' s ,002  /1L lD ) ) !#J-  ' I (5//*UC:P:P %u  s # # % J  . =>>.1 h $ $)1)9J &= r/c:V^8dQhR\\,/#r()rr)r,s"r-r.r.B sT%[r/c>R\3R\3R\3R\3.#)zOrdered provider detection chain, built at call time so ``_try_*`` patches are picked up. ``openai-codex`` is deliberately absent (shifting allow-list breaks guessed-model fallback). rcr local/customzapi-key)rr0r#rrDr/r-_get_provider_chainrJB s. '&))< -.>*;U!V r/cRV^8dQhR\R\\,R\/#)r)rrVr*rXrrm)r,s"r-r.r.| s%  # # $ r/c"V'gR#\W4p\PV4pVfR#\P!4V8dE\P VR4\ P VR4\ P VR4R#R#)zZTrue iff this provider endpoint is unhealthy and unexpired; lazily evicts expired entries.FNT)rrTrr=r_aux_unhealthy_logged_atrU)rrVrrs&& r-rr| so  u /C%))#.J yy{j   d+ $$S$/!!#t, r/clV^8dQhR\R\\,R\\,RR/#)r)rrBrVr*NrL)r,s"r-r.r. s4     sm  9A#     r/c r\P!4p\W4pV\PVR4, ^<8duV\V&\PWC4p\ P RT;'gRV\PV\4\^\WS, 444R#R#)zCLog a skipped unhealthy provider at most once per minute per label.rz,Auxiliary %s: skipping %s (%s, retry in %ds)callN) r=rr\rrTrr+rU_AUX_UNHEALTHY_PAYMENT_REASONrrW)rrBrVnowrrs&&$ r-_log_skip_unhealthyrb s ))+C u /C % ) )#s 33r9(+ %)--c7  : NNFE#8#<#. s,GbTzGrTF)r3)r-rhsf&r- _contains_anyrm s, 3,G,33,3,3,G, ,,r/c0V^8dQhR\R\/#r)rcr*rrm)r,s"r-r.r. s9r/c\VRR4pVR8H;'g5VR9;'d(\\V4P4\4#)z\Payment/credit/quota exhaustion: HTTP 402, or a billing/quota body on 403/404/429/no-status. status_codeN>N)rqrmrXr_PAYMENT_KEYWORDSrcstatuss& r-_is_payment_errorrz sJ S- .F S=  ''^^M#c(..:JL],^r/c$V^8dQhR\/#r(rl)r,s"r-r.r. sDr/c^RIHpV!RR7PRJ# \d"p\P RT4Rp?R#Rp?ii;i)zMReturn True only when the fresh Nous account API says paid access is allowed.)get_nous_portal_account_infoT) force_freshz8Auxiliary Nous paid-entitlement refresh check failed: %sNF)hermes_cli.nous_accountr}paid_service_accessrrr)r}rcs r-*_nous_portal_account_has_fresh_paid_accessr sDH+=QQUYYY  OQTUs A AA  rate limitc0V^8dQhR\R\/#rorp)r,s"r-r.r. sAAiADAr/cP\\V4P4\4#)uServer busy, credential fine ("at capacity upstream … not your API key's rate limit"): back off, never bench the credential (#108349). Same phrase table as the main classifier.)rmrXrrrcs&r-_is_overloaded_errorr s S)+? @@r/c0V^8dQhR\R\/#rorp)r,s"r-r.r. s x xi xD xr/c\V4PR8XdR#\VRR4R8wdR#\V4P 4p\ V\ 4;'g\ V\4'*#)u429 rate limit (not billing/quota, which _is_payment_error owns). OpenAI's RateLimitError may omit .status_code — matched by class name. A generic 429 without billing keywords counts as a rate limit. RateLimitErrorTrrNrvF)r+rHrqrXrrm_RATE_LIMIT_KEYWORDS_RATE_LIMIT_BILLING_KEYWORDS)rc err_lowers& r-_is_rate_limit_errorr s_ Cy--sM4(C/C I $8 9 w wyZvAw=wwr/c0V^8dQhR\R\/#rorp)r,s"r-r.r. s N N9 N Nr/c<\P!\4;_uu_4^RIHp\ W4'd RRR4R#RRR4R\ V4P9;'gR\V4P49# +'giLL;i)zFull-budget request timeout, distinct from a fast connection drop. A timeout burns the whole ``timeout`` budget, so a same-provider retry on the compression path doubles wall time; fast drops stay on the retry path. )APITimeoutErrorNTTimeout timed out) rrrr2rr?r+rHrXr)rcrs& r-_is_timeout_errorr sn   [ ) )* c + + * ) + * S ** * M MkSX^^=M.MM * )s B  B c0V^8dQhR\R\/#rorp)r,s"r-r.r. siDr/c`\P!\4;_uu_4^RIHpHp\ WV34'd RRR4R#RRR4\\V4PR4'dR#\\V4P4R4# +'giLZ;i)zSConnection/network errors (endpoint unreachable), as opposed to 4xx/5xx API errors.)APIConnectionErrorrNT) ConnectionrDNSSSL) zconnection refusedzname or service not knownzno route to hostznetwork is unreachablerzconnection resetzincomplete chunked readzpeer closed connectionzresponse ended prematurelyzunexpected eofremoteprotocolerrorlocalprotocolerror) rrrr2rrr?rmr+rHrXr)rcrrs& r-_is_connection_errorr s~   [ ) )> c@ A A * ) A *T#Y'')PQQ S),  * )s B B- c0V^8dQhR\R\/#ro)rr)r,s"r-r.r. smm)mmr/c\\VRR4;'g\\VRR4RR4#)z[HTTP status on the exception itself or on its ``response`` (None when neither carries one).rrNrrrs&r-_exc_http_statusr s. 3 t , l lZQU8VXegk0llr/c0V^8dQhR\R\/#rorp)r,s"r-r.r. sNNyNTNr/c\V4'dR#\V4p\V\4;'d$VR8H;'gRTu;8*;'dR8#u#)zOne-off transport blip worth retrying on the SAME provider: connection/stream-close errors plus pure 5xx/408. Deliberately narrow: payment/auth/rate-limit errors switch provider, refresh creds, or rotate the pool. TiirK)rrr?rWrxs& r-_is_transient_transport_errorr sP C   c "F fc " M M# (L(L9L9L9LM9LMr/g?c$V^8dQhR\/#r(r)r,s"r-r.r. s***r/c^RIHpHpV!V!4RR4pVf\#\ ^\ \ V4^44# \d \u#i;i)zSame-provider retries for a transient blip: ``auxiliary.transient_retries`` (default 2), clamped to [0, 6]; config-read failures fall back to default.rVrtransient_retries)rrWrX_DEFAULT_TRANSIENT_RETRIESrrrWr)rWrXrs r-_transient_retry_countr sS*:km[2EF-0[)Vc!SSSTEU>VV *))*s AAAAc0V^8dQhR\R\/#rorp)r,s"r-r.r.' s ` ` `d `r/c\VRR4pVR8XdR#\V4P4pRV9g)R\V4PP49dR#RV9;'dVR8H;'gR V9#) z$s)BTBTBZBZB\)\  ) _ _v}/^/^@QU^@^_r/c<V^8dQhR\R\R\/#)r)rcparamr*)rrXrm)r,s"r-r.r.3 s&\\\3\4\r/cT;'gRP4pV'gR#\V4P4pW#9;'d\V\4#)zProvider 400 for an unsupported request parameter: the parameter name plus a generic unsupported/unknown/unrecognized marker, so call sites can retry without the key.rjF)rrXrmr)rcr param_lowerrs&& r-_is_unsupported_parameter_errorr3 sG;;B%%'K C I  # [ [ iAZ([[r/c0V^8dQhR\R\/#rorp)r,s"r-r.r.= s|||t|r/cf\VRR4pVe VR 9dR#\V4P4p\VR 4'dR#RV9dRV9gRV9dR#RV9d RV9dR#RV9d R V9dR#\VR 4'dR#\ VR4;'g \ VR4#) a2Provider 400/422 rejecting the structured-output field, on either wire: OpenAI ``response_format`` (incl. vLLM's ``guided_grammar``/xgrammar failures) or Anthropic ``output_config.format`` ("Extra inputs are not permitted"). Callers tolerate an unconstrained reply, so the reaction is one retry without it.rrNFTzextra inputs are not permittedrr unavailabler )guided_grammarxgrammarcompile_grammar_error)zresponse mime typeresponse_schemaresponse_json_schema)rqrXrrmrrs& r-_is_structured_output_rejectionr= sS- .F fJ6C IY WXX'94Y&/Y*FI%-9*D I%-9*D Y abb *30A B { {FefikzF{{r/c0V^8dQhR\R\/#rorp)r,s"r-r.r.] s 2 2y 2T 2r/c^\VRR4pVe VR9dR#\\V44#)aProvider 400 rejecting a reasoning wire control by name (``reasoning_effort``, ``reasoning``, ``thinking``/``think``). Chat-only models behind OpenAI-compatible relays reject the top-level ``reasoning_effort: none`` a disabled ``reasoning_config`` projects on the custom profile ("Unrecognized request argument supplied: reasoning_effort", #112781); the route default is the right answer for such a model, so the reaction is one retry without any reasoning field.rrNFr)rqrrXrxs& r-_is_reasoning_field_rejectionr] s1 S- .F fJ6 'C 11r/c0V^8dQhR\R\/#rorp)r,s"r-r.r.i s55)55r/c^\VRR4pVe VR9dR#\\V44#)aProvider 400 refusing to switch reasoning OFF ("Reasoning is mandatory for this endpoint and cannot be disabled"): the field is understood, only the disable is refused, so the rung steps the effort up to the floor instead of dropping the field (agent/auxiliary_reasoning_floor.py).rrNFr)rqrrXrxs& r- _is_reasoning_required_rejectionri s1S- .F fJ6 *3s8 44r/cFV^8dQhR\R\\,/#r^rr)r,s"r-r.r.s s--d-x~-r/c \V4pVPRR4RJpVPRR4RJ;'gTpVPR4p\V\4'dVP 4UUu/uF9wrE\ V4P 4P4\9gK7WEbK; ppp\V4\V48wd"V'dWaR&MVPRR4RpV'dV#R#uuppi)zCopy *kwargs* without reasoning wire controls (top-level ``reasoning_effort``, the adapter's private ``_reasoning_config`` and every ``extra_body`` reasoning key); None when nothing was removed, so call sites don't retry an unchanged request.reasoning_effortNr&r{T) rrrr?rrXrr_PROFILE_REASONING_KEYSr)r; retry_kwargschangedr{rrr;s& r-_without_reasoning_fieldsrs sS_ ,-6\*  t4G"<,,ss 84D1Dc0V^8dQhR\R\/#rorp)r,s"r-r.r. s9r/c\VRR4p\V4P4p\VR4'dR#VR9dR#\VR4#)u"Requested model doesn't exist" (404 / invalid model) — typically a long-lived process pinned a since-dropped model. Excludes billing keywords, which :func:`_is_payment_error` owns.rrNF) creditsinsufficient fundsbilling out of fundsbalance_depletedno usable credits free tier free-tiernot available on the free tier>Nrru) zmodel does not existz#does not exist in our configurationzopenrouter catalogzis not a valid modelz no such modelzmodel not foundz the model `model_not_foundz unknown model)rqrXrrmrs& r-_is_model_not_found_errorr s[S- .FC IY! %% % r/c0V^8dQhR\R\/#rorp)r,s"r-r.r. siDr/c\VRR4pVR9dR#\V4P4p\V4'dR#\ VR4'dR#\ VR4#)a"This route cannot serve this model" 400 (capability mismatch, e.g. a Codex/ChatGPT-account fallback asked to run a non-OpenAI model). Auth/payment predicates don't fire, so this keeps the chain going instead of aborting. Excludes billing 400s and not-found 400s.rrNF>Nr) rrrrrrpayment requiredrrr model_not_supported_on_free_tierquota)zis not supported when usingzmodel is not supportedznot supported with thisznot supported for this accountmodel_not_supportedzdoes not support this modelzunsupported model)rqrXrrrmrs& r-_is_model_incompatible_errorr shS- .F [ C I %%Y!  % r/c0V^8dQhR\R\/#rorp)r,s"r-r.r. sjj jdjr/c\V\4'gR#\V4P4pRV9;'dRV9;'dRV9#)udHTTP-200 empty/malformed ChatCompletions — a capability failure routed like model incompatibility.Fz auxiliary zllm returned invalid responsezchoices[0].message)r?rcrXr)rcrs& r-_is_invalid_aux_response_errorr sJ c< ( ( c(.. C 3  i i#Bc#I i iNbfiNiir/c0V^8dQhR\R\/#rorp)r,s"r-r.r. sZZ)ZZr/ca\V4eR#\VRR4p\V\4'dRV9dVP R4MTo\S\ 4'd\ SP44#\S\4;'d;\;QJdV3RlR4F 'gK R# R#!V3RlR44#)uDetect a structured provider failure that has no HTTP status. OpenAI-compatible relays may commit SSE with status 200, then send an OpenAI-style ``error`` event. The SDK raises a status-less ``APIError`` with ``body=data["error"]`` — the INNER error object or a bare string (an ``{"error": ...}`` wrapper is accepted too). Any non-empty structured error in that status-less shape is a route failure; ordinary HTTP errors keep their existing status-based classifiers, and message text alone is insufficient. NFbodyrc3F<"TFpSPV4xK R#5ir8)r)r#rerrs& r-r%;_is_statusless_structured_provider_error.. s(Y=X=XrT)r+coder) rrqr?rrrXrmrr3)rcrrs& @r-(_is_statusless_structured_provider_errorr s( 3 %D)$55'T/$((7 tC#sCIIK  c4 Y YSS(Y=X(YSSYSYS(Y=X(Y%YYr/cRV^8dQhR\\,R\R\/#)r)rBrcr*rrXrrm)r,s"r-r.r. s*pp8C=pypTpr/cfV\9;'d"\V4;'dR\V49#)u8True when a transient error on a critical-path task should go straight to fallback. Carve-out: a fast first-token fail (dead stream within the no-progress window, zero output — see ``_timeout_message``) is cheap and keeps the same-provider retry; mid-stream stalls and hard-ceiling timeouts skip to fallback. zno-progress timeout)_TIMEOUT_NO_RETRY_TASKSrrX)rBrcs&&r- _should_skip_same_provider_retryr s3 * * o o/@/E o oJ_gjkngoJoor/c(V^8dQhR\RR/#)r)rr*NrW)r,s"r-r.r. s))C)D)r/c Z\V4p\4p\;_uu_4\Uu.uF7pV^,V8XgK\\ V^,44V8XgK5VNK9 upFp\P VR4K RRR4R#uupi +'giR#;i)a@Drop this profile's cached auxiliary clients for a provider so fresh creds are used. Scoped to the calling profile (``hermes_home_key()`` is the first key slot): a rotation in one profile must not drop another profile's client for the same provider in a multiplexing gateway, since that profile's credentials did not change. Entries are popped, not closed: a concurrent caller may be mid-request on the shared client (closing it raises ReadError / "client has been closed" for them); the dropped client is retired by GC like the FIFO overflow path in ``_get_cached_client``. N)rr_client_cache_lock _client_cacherXr)rrhomers& r-_evict_cached_clientsr s)2J  D  #0^=C1v~*A#c!f+*NR\*\C=^C   c4 (^  ^   s( BBB$B* BB B* c0V^8dQhR\R\/#)r)rlr*r)r,s"r-r.r. s#$r/c$VfR#Rp\;_uu_4\\P44F;wr#Ve V^,MRpVfKW@Jg\ VRR4VJgK2\VRpK= RRR4V# +'giT#;i)aDrop cache entries whose stored client (or its ``_real_client``) is *target*; True if any evicted. Used when a cached client is poisoned (closed transport after a timeout). Async wrappers must expose the same ``_real_client`` as their sync sibling or the async entry survives. NFrT)rrrrrq)rlevictedrrcacheds& r-r,r, s ~G  }2245JC!&!2U1XF!v'776>[_;`dj;j!#& 6  N   Ns3A>A>' A>> B c<V^8dQhR\R\R\/#)r)rrr*r)r,s"r-r.r.s!#cSr/c<Ve&\V43Uu.uFq"'gK VNK upM.pV'gL\VRR4p\V4'dV!4M.p\ RRT;'gR 444pV'gR#\P!^R7pVF4pVPVPR44VPR 4K6 VP4#uupi \d"p\P RT4Rp?R#Rp?ii;i) aSecret-safe digest over the runtime key(s) backing the cache hint. When ``entry`` (the peeked selection) carries a key, only THAT key is digested: rotating a sibling account must not churn this entry's cached client. Otherwise every pool entry contributes, taken WITHOUT availability filters (``pool.entries()``, not ``peek()``): an entry benched by a per-model cooldown still counts, so a token rotated while the cooldown is active changes the digest too (#113022 point 5). Only the blake2b of the keys enters the cache key. Nentriesz.sX!RAVWaa!Rs  c38"TFp\V4xK R#5ir8)r)r#rs& r-r%rs!RMq"7":":Mr digest_sizeutf-8rD) rrqrrrrr"hashlibblake2brencode hexdigest) rrrkeys entries_fnrrcdigestrs && r-_pool_credential_digestr sAF@Q-e46 <6!!AA6 ::`` when ``peek()`` names an entry, ``::`` when every entry is filtered out (cooldown) but keyed entries exist. A token rotated or refreshed by another process yields a new client instead of a 401 round trip on the cached one; the stale entry ages out through the non-closing FIFO cap (#113022). rrrjz (cache hint)r2r>rjrr) rrrrrrr rXrqr)rrrrrrr entry_ids&$ r-_pool_cache_hintr s)2JV),7,W[[-D-]-]H[H]^ ++ &z? CD | Z .E $T 1F>C>Os75$+11r288:UWH F\8*AfX ..r/rrcV^8dQhR\R\\\\3,R3,R\\,/#)r)rVtable.r*)rXrr)r,s"r-r.r.Is8U5c?C3G-HXVY]r/cFVFwr#\W4'gKVu# R#)zGFirst provider in ``table`` whose host matches ``base_url``, else None.N)r)rVrrrs&& r-_provider_for_hostrIs#  0 0O  r/c V^8dQhR\R\R\\\\3,,R\\,/#)r)resolved_providerrrr*rXrrr)r,s"r-r.r.Qs=,,,$',7?S#X7O, c],r/c  \V4p\\VRR4;'gR4p\V4p\VP R4;'gR4pVP R4p\VRR4pV'dV'dW5P R48Xdj\ V\4'dTV'dLW8XdF\ V4\ V48wd-\PRV\V4\V44R#VR 9dM\T;'gR4P4P4;p PR4'dV #T#\V\4p V eV #V'Ed\V4pVP RR4p V 'dV R 9d\P !\"4;_uu_4^RIHp V P V 4p V 'd\V R R4R8Xdx\VP R4;'g\V R R4;'gR4P)R 4pV'd(\+V\V44'd V uuRRR4#RRR4R#R# +'giR#;i) u4Infer which provider pool can recover the current auxiliary client. None when the client targets a different host than the session's configured endpoint for that provider: a rejection there says nothing about the key, so rotating/quarantining it would kill a working credential (Miho report — proxy users).rVrjrUNruAuxiliary: %s rejected the session key at %s, but the session's endpoint is %s — endpoint mismatch, not a dead key; skipping credential rotationr)rrrr>rjrr)rrXrqrrr?rrr+rrrrr_POOL_PROVIDER_BY_HOSTrrrrrr r)rrrrbaserrt_basert_key client_keypinnedknown rt_providerrrs&&& r-_recoverable_pool_providerr"Qs )):;J wvz2.44" 5D%l3G'++j)//R0G [[ #FD1J Z;;z+BB63''Fz7K%)AA V 1$ 79J79S U//$'(9(?(?R$@$F$F$H$N$N$PP&\\]fggvwmww t%; .__annotate__s    r/c<R\S4/pSeSVR&SPSeSMTTS;'gRR7pVfR#\S4R#)rNrr)rr error_context api_key_hintFT)rXmark_exhausted_and_rotater)r'r* next_entryrcr#rrrrs& r-_rotate'_recover_provider_pool.._rotatesc)2CH(=  "+6M- (33'2'> O'n6L6L4   j)r/Trrsrv)rryrwrrrrrqrrrrzrr)rrcr#load_excr.rrrrs&fd @@@r-_recover_provider_poolr1s )2J$Xz9E t++--#}d3K  c  # # % 1 !* -s|s|C  )=c)B)Bs| ;  PR\^fgsC D%DDrZc(V^8dQhR\\,R\R\\,R\\,R\\,R\\,R\\\\3,,R\\,R \R \\ ,R \\ ,R \\,R \ R\R\\,R\R\\\\3,,R\\\\\3,3,/#)r)rBrresolved_modelresolved_base_urlresolved_api_keyresolved_api_moderr9rmr%r#rieffective_timeouteffective_extra_bodyr(rrZr*) rrXrrrrOrWrmr)r,s"r-r.r.s)&)& c])&/2)&DLSM)&})&8@ )& })&5=T#s(^4L)&# )&+/ )&>Fe_ )&  )& '/tn )& JO )&  )& 3;4. )& OS )&DcN+)& 3S#X )&r/cVR8Xd\WVWOR7wpppM\WWWEVR7wpp\VV4pVf\RT;'gR RV R24h\ \ VRR 4;'gR 4p\ T;'gTT;'gTTYYYT;'gTVR 7 pV'd\V4VR &\VV4'd\VR ,4VR &VV3#) zURebuild (client, request kwargs) for a same-provider retry after credential recovery.r)rrrVrUr)rrVrUror Auxiliary r_z : provider z$ could not be rebuilt after recoveryrVrjr%r#rirr{r(rVrBrZrm) resolve_vision_provider_client_get_cached_client_effective_provider_for_clientrcrXrq_build_call_kwargsr_is_anthropic_compat_endpoint#_convert_openai_images_to_anthropic)rBrr3r4r5r6rr9rmr%r#rir7r8r(rrZeffective_provider retry_client retry_model retry_basers$$$$$$$$$$$$$$$$$ r-_prepare_same_provider_retryrFs x8V&DU$9 5L+ %7 *$|% ! k]()`` label points at, or None when the label is not a configured-chain candidate or the index no longer resolves.Nzfallback_chain\[(\d+)\]fallback_chain) rmatchrGrr?rrWgrouprr)rBrrchainrs&& r-_fallback_chain_entryrOs x +X6A *40445EF*4UD*A*Ac!''!*o&tud++555 sAB"" B10B1cFV^8dQhR\R\\,/#r)rawr*r)r,s"r-r.r._s#(5/r/c\V\\34'd)\V\4'gV^8d \V4#R#)zYCoerce a config ``timeout`` to a positive float, or None (rejects bools, which are ints).N)r?rWrOrmrs&r-_coerce_positive_timeoutr_s2#U|$$ZT-B-BsQwSz r/chV^8dQhR\\,R\R\\,/#r)rrXrO)r,s"r-r.r.fs. M M(3- M3 M8E? Mr/ch\W4p\V'dVPR44#R4#)uBPer-entry ``timeout`` for a configured fallback candidate, or None (keep the task-level timeout). Inheriting the primary's deadline used to kill healthy-but-slower fallbacks. A fallback candidate previously inherited the exact timeout the primary provider was called with. When that deadline was tuned for the primary (or the primary simply consumed its whole budget before failing over), the fallback aborted on the same clock even when independently healthy — a 163k-token compression that needs ~90s on the fallback died at the primary's 30s deadline every turn (#62452). rN)rrr)rBrrs&& r-_fallback_entry_timeoutrfs, "$ 1E #EEIIi$8 LLt LLr/c0V^8dQhR\R\/#)r)rr*rW)r,s"r-r.r.ssIIIIr/c\P!RT;'gR4pV'd VP^4P4#\ T;'gR4P4#)z>Recover the provider identifier from a fallback display label.zJ(?:fallback_chain\[\d+\]|fallback_providers\[\d+\]|main-agent)\(([^)]+)\)$rj)rrrrrX)rrs& r-_fallback_provider_from_labelrssO HHbdidodomo pE%*5;;q>   !HEKKR0@0F0F0HHr/c,a]tRtRtoV3RltRtVtR#)_FallbackDestinationiycj<V^8dQh/S[;R&S[;R&S[S[,;R&S[S[,;R&#)r)rrVrorrL)r,rQs"r-r.!_FallbackDestination.__annotate__ys;MMsm C= r/rDNrHrIrJrK__annotate_func__rNrOrPs@r-rryr/rc V^8dQhR\R\R\\,R\\,R\/#)r)rrVrorr*)rXrr)r,s"r-r.r.sC E E E  E,4SM EBJ3- E Er/cV'g\V4'dRpM\P!\4;_uu_4^RIHpT!Y;'gRT;'gRR7p\ VPR4;'gR4P4;'gRpRRR4\WW#4# +'giL;i)r,rNrj)rr r6ro) rmrrrrrrXrrr)rrVrorrrs&&&& r-_complete_fallback_destinationrs  .x 8 8+H$$Y//P2&:J:JdY^YdYdbdw{{:6<<"=CCEMM 0 H DD 0/sB4$B4B4B44 C cV^8dQhR\\\3,R\R\\,R\/#)r)r fb_clientfb_modelr*)rrXrrr)r,s"r-r.r.s>OO S>O&)O5=c]OOr/cB\VPR4;'gR4P4p\VPR4;'g\VRR4;'gR4P4p\VPR4;'gVPR4;'gR4P4;'gRpT;'g=\VPR4;'gR4P4;'gRp\ W4WV4#)rrjrVro transportNr)rXrrrqr)rrrrrVrors&&& r- _fallback_destination_from_entryrs599Z(..B/557H599Z(TTGIz2,NTTRTU[[]H599Z(HHEIIk,BHHbIOOQYYUYH  E EEIIg.44"5;;= E EE )(h NNr/c V^8dQhR\\,R\R\\,R\R\/#)r)rBrrrr*)rrXrr)r,s"r-r.r.s<   3- $' 3;C= LO  r/c \VRR4p\V\4'dV#\W4pVe \ WQV4#\ \ V4\\VRR4;'gR4RV4#)z^Route identity of a fallback request: attached destination, else configured entry, else label._hermes_fallback_destinationNrVrj)rqr?rrrrrrX)rBrrrattachedrs&&&& r-_fallback_destinationrsxy"@$GH(011 !$ 1E /(KK )%h/WY TV5W5]5][]1^`dfn r/c V^8dQhR\R\\,R\R\\\3,/#)r)rmri destinationr*)rrrr)r,s"r-r.r.s9   #D> ;O  4: r/c ^RIHpHp^RIHpT!YVP VP VP;'gRVP;'gRV!4V!W4'dRR7#RR7#)z^Plan one destination at the configured TTL (1h must not regress to 5m); one-shots never cache.)configured_cache_ttl#plan_cache_sections_for_destination)is_one_shot_requestrjTN)rrVror cache_ttlcache_disabled) rrragent.prompt_cachingrrrVror)rmrirrrrs&&$ r-"_replan_synchronous_cache_sectionsrspf8 .+"6"6AUAU%%++;3D3D3J3JVjVl28CCt JN r/cDV^8dQhR\R\\,R\R\\,R\\,R\\ ,R\R\ R \\ ,R \ R \ R \R \ \\3,/ #)r)rrBrmrir%r#r7r8r(fallback_entry task_configapply_fast_laner*) rrrXrrOrWrrmr)r,s"r-r.r.s%08 IM D>(0EMc]59MUUYN (, ?C   #s(^ r/c &YWrV 'dG\WPVPV PR4V PR4V WVR7 wr\ W#VR7wr\ VPVPVWLWWVP VR7 pV#)zYBuild request kwargs for one fallback destination (cache-section replan + fast-lane cap).rractual_provider actual_modelrrequested_model route_configleak_guard_configr#r{)rr;)_compression_fast_lane_controlsrrrrr?rV)rrBrmrir%r#r7r8r(rrrfallback_max_tokensfallback_extra_bodyfallback_messagesfallback_tools fb_kwargss&$$$$$$$$$$$ r-_fallback_request_kwargsrs0:,3R "6"6[EVEV-11*=*..w7n)Ma 4 0 )K8hs(t%"k//1B~&T_ThThosuI r/cVV^8dQhR\R\\,R\R\\,R\R\R\ \ \\\3,\\\\\,.\\\3,3,3,/#)r)rrrrBr7rr*) rrrXrOrmrrrr)r,s"r-r.r.s!R!R!R&sm!R7:!REMc]!R!R/3!R c3h3Xc]:SUYZ]_bZbUc:c1d de!Rr/c >a a \W24pVe+Wt8wd%\PRT;'gRW'V4Tp\W0W4o VR8Xd \ V4M/p\ W24;'g/p \ R RVRVRV RVRV/VBo R V V 3R llp S \S 3/S BV 3#) a,Resolve the destination + first-attempt kwargs for a fallback candidate. Returns ``(destination, kwargs, rebuild)`` where ``rebuild(provider, client, model)`` produces kwargs for the credential-refreshed retry destination. A configured-chain entry's own ``timeout`` overrides ``effective_timeout``. zJAuxiliary %s: %s using its configured timeout %.0fs (task-level was %.0fs)r_ compressionrBr7rrrc V^8dQhR\R\R\\,R\\\ \\3,3,/#)r)rrrr*)rXrrrrr)r,s"r-r.._plan_fallback_candidate..__annotate__sJXX3XXHSMXeL`bfgjlogobpLpFqXr/c <\TSP;'g!\\VRR4;'gR4SPT;'g SP 4pV\ V3/SB3#)rVrj)rrVrXrqrorr)rrrretry_destinationcommonrs&&& r-_rebuild*_plan_fallback_candidate.._rebuildsk0 k**XXc'&*b2Q2W2WUW.X  %"<"<;+<+< !":;L"WPV"WWWr/rD)rrr+rrGrrr) rrrrBr7rr fb_timeoutrrrrrs &&&$$$, @@r-_plan_fallback_candidaters)8J*"A  % NNFH2C ''LK6:m6K,T2QSK*4:@@bN  %6GU1@DKF XX 0GG QQr/tagcV^8dQhR\\,R\R\R\R\R\R\\,RR /#) r)rBr fb_providerfb_errrVrrr*N)rrXr)r,s"r-r.r.sV ? ? 3- ?#& ?58 ?BK ? ?  ?/7} ?  ?r/c\T;'gT\V4YF;'gRR7V'dRV R2MRp\PRT;'gRWQWs4R#) aThe candidate cannot serve this walk (``reason`` = its ``_FALLBACK_REASONS`` capacity label, None = dead token): mark it unhealthy so the ordered re-walk skips it and the caller moves on to the next entry. Transient classes get a short hold, payment/quota and dead tokens the long one.zstale fallback credential)rrrVrzis out of capacity ()z$has a stale/unrefreshable credentialuKAuxiliary %s%s: fallback candidate %s %s (%s) — skipping to next fallbackr_N)rrrr)rBrrrrVrrwhys&&&&$$$ r-_quarantine_fallback_candidaters^x%Fv%N"G"G,GI/5  *:`C NN`>>63#?r/clV^8dQhR\R\\\\\,.\ \\ \\3,3,3,R\R\R\ \\\ \\ \\3,\3,,3,/#)r)rrebuildrr#r*)rrrXrrrrrm)r,s"r-r.r.s% sC#/7KTRUWZRZ^7[1\\ ]   3sDcN4HHIJ JK r/cN\VPVP4pVR8XdRV/M/pVR9do\V3/VB'd]\ W@P 3/V'dRR/M/BRVP;'gRRVP /BwrgVeV!WFV4wrWFW33#VR3#) zAfter an auth error on a fallback candidate: refresh credentials and rebuild the request. Returns ``(refresh_provider, retry)``; ``retry`` = ``(client, kwargs, destination)`` or None.r<r#NrTrVro>Nrjr)rrrVr{r=rro) rrrr#rrefresh_kwargsrCrDrrs &&$$ r-_plan_fallback_auth_retryrs3;3G3GI]I]^K;F+;U&7[]N,,1N{1m^l1m1m$6 **% GQ d/CWY%  ))11T% >>&sm>7:>EMc]>^b>%>.6sm>DLTN>>59>MUUYN>c] >r/cTaaa\WVSVRWGVWiV R7 wrp RV3Rllo^RIHoRVVV3RllpV!W V 4# \dp\ T4'g:\ T4pTfh\ SY+PYPTR 7Rp?R#\YR \TR R 4R 7wppT pTeMT^,pT!T!uRp?# \d*p\ T4'g\ T4fhRp?MRp?ii;i\ STTTTPR7Rp?R#Rp?ii;i)aCall one fallback candidate with stale-credential recovery: on an auth error refresh its credentials and retry once with a rebuilt client; if that also auth-fails, quarantine the provider and return None so the caller moves on. A capacity error (quota/rate-limit 429, 402, connection, route-incompatible model, malformed response) also quarantines and returns None so the ordered chain advances to the next configured entry (#106367); other errors raise. ``effective_timeout`` is the task-level deadline; a configured-chain candidate with its own ``timeout`` entry gets that instead, so a fallback tuned differently from the primary is allowed its own budget (#62452). T rBr7rrmrir%r#r8r(cjV^8dQhR\R\\\3,R\R\/#r)rrequest_kwargsdestr*rrrXr)r,s"r-r.3_call_fallback_candidate_sync..__annotate__+s2   c  4S>  AU  Z]  r/c p<aa\\SVSPSPVVV3RlR7S4#)c ^<\SVS\SPSP4R7# force_stream)r_provider_requires_streamrrV)rrrrBs&r-r>_call_fallback_candidate_sync.._send../s$'<GT!:4==$--!X(r/rror)rJrrro)rrrrBsf&fr-_send,_call_fallback_candidate_sync.._send+s3% "    r/)send_with_parameter_rungscjV^8dQhR\R\\\3,R\R\/#rr)r,s"r-r.r8s8QQQd38nQL`QehQr/c&<aS!VV3RlWSR7#)c<S!WS4#r8rDcrkrrs&&r-rI_call_fallback_candidate_sync.._send_recovering..: %t,r/rHrD)rrrrrrBs&&fr-_send_recovering7_call_fallback_candidate_sync.._send_recovering8s( ,f4Q Qr/N)rVrFrUrjrr#ry) r!agent.auxiliary_fallback_recoveryrrrrrrrVrrq)rrrrBrmr%r#rir7r8r(rrrrrcapacityrretryfailed_destination retry_errrrs&&&d$$$$$$$ @@r-_call_fallback_candidate_syncrs>'?XDDUx+) '#KG   LQQ kBB f%%.__annotate__cs2  C c3h G[ `c r/c <"^RIpTP\\WVPVP R7GRjxL S4GRjxL #LL5i)rNr)rrrJrrro)rrrrrBs&&& r-r-_call_fallback_candidate_async.._sendcsI&& ")&4==cgcpcpq q    q s!:AA A A AA)send_with_parameter_rungs_asynccjV^8dQhR\R\\\3,R\R\/#rr)r,s"r-r.r ls8QQsQDcNQRfQknQr/cB<a"S!VV3RlWSR7GRjxL #L5i)c<S!WS4#r8rDrs&&r-rJ_call_fallback_candidate_async.._send_recovering..nrr/rHNrD)rrrrr rBs&&fr-r8_call_fallback_candidate_async.._send_recoveringls(4 ,f4QQ QQs N (async))rVrrTrUrjr)rVr) rrr rrrrrrVrrq)rrrrBrmr%r#rir7r8r(rrrrrrrrrrrr s&&&d$$$$$$$ @@r-_call_fallback_candidate_asyncrVsP '?XDDU;) '#KG  RQQ%iKHHHH f%%AD9E!+D9 C!CC!D>E! D,D D9DD93E9D>>E payment errorfailed_base_url failure_scopec V^8dQhR\R\R,R\R\R\R\\\\3,,R\\\,\\,\3,/#) r)failed_providerrBNrrrrr*)rXrrrr)r,s"r-r.r.sp$$$ #d $;>$$.1$HPQUVY[^V^Q_H`$ 8C=(3- ,-$r/c VP4P4p\V4PR4;'g \ 4p\ Wq4'gR #V0pV'd5VP4V9d VP VP44VU u0uFp \V 4kK p p \VRW4R7p .p \4Fwr\V 4pV'gW9gV !V RV4'dK0\W4'd$\WVR7V PV R24KdV!4wppVe5\PRT;'gRY T T;'gR4VVV 3u#V PV 4K \P!R T;'gRW R P#V 44R #uup i) zTry the auto-detection chain after a payment/credit or connection error, skipping the failed provider (and the main-provider path when it maps to the same backend). Returns (client, model, label) or (None, None, "").rNrrry (unhealthy)u2Auxiliary %s: %s on %s — falling back to %s (%s)r_rz<t/D1D1  !% < < 6H I LLE7,/ 0     KKLHZHZQZ \5%' ' U/ NNQ>>66DIIe.__annotate__s,   HSM S $ r/c:<S!SPWVR7SS4#)r1)build)rrrVr. failed_identrr0s&&&r-_skip#_failed_backend_skip.._skips)$  ! !88 ! TVbdq  r/r) agent.backend_identityr.r/r0rrr5MODEL CREDENTIAL) rr,rrr/ skip_modelr7r.r6r0s &&$d @@@r-r r s|\[$$"++-335==J"(( _)NL!ddJl&8&8LLcLcM   Lr/cV^8dQhR\R\R,R\R\\,R\R\R\\\,\\,\3,/#) r)rrBNrr,rrr*rXrrr)r,s"r-r.r.sb)7)7)7 #d )7;>)73-)79<)7RU)7 8C=(3- ,-)7r/c \4;'gRP4p\4;'gRP4pVP4R8Xd"\ V4wrV'd V 'gR #YrvV'dV'dVP4R9dR #VR8Xd6V\ 9g\ Wg4'g\PRW V4R #\V4p \WVVR7!WgV 4'dR #\Wj4'd\WaV R7R #\WgR7wrV fR #R V R 2p \PR T;'gR Y Y;'gT4Y;'gTV 3# \dRRrLVi;i)a8Last-resort fallback to the main agent provider + model after the configured chain is exhausted. ``failed_model`` scoping per ``_failed_backend_skip``; same-URL custom endpoints serve many models, so a hung aux model says nothing about the main model's health. Returns (client, model, label) or (None, None, "").rjrDNru^Auxiliary vision: %s on %s — main agent provider %s accepts no image input, not falling backrryrrz main-agent(ruCAuxiliary %s: %s on %s — falling back to main agent model %s (%s)r_r>rjr)rrrNrrK_PROVIDERS_WITHOUT_VISION_main_model_supports_visionrr+rr rrbresolve_provider_clientr)rrBrr,rrr" main_model _agg_provider _agg_model main_base_urlrr3rs&&&&&& r-_try_main_agent_model_fallbackrHs)*00b779M"$**113J%$;J$G! J! !$1z  m.A.A.C|.S x 6 6>YZg>t>t  t] <+M:M ?'))6MSSm;;M-H,!8-!b~- *E KKU@\@\R\^ //Z 66 ,!%t,s'E;;F  F c\V^8dQhR\\,R\\,/#rArrXrW)r,s"r-r.r.s&EEx}E#Er/c VR8Xd\#R#)z]Minimum context length for an auxiliary task; None = no floor (only ``compression`` has one).rN)r{rHs&r-_task_minimum_context_lengthrLs%)]%: !DDr/c jV^8dQhR\R\R\R\R\\,/#)r)rrrVrUr*)rXrrW)r,s"r-r.r.s7 = = =C =3 =VY =cklocp =r/cV'gR#\WW0R7p\ T\ 4'd T^8dT#R# \d#p\PRYT4Rp?R#Rp?ii;i)zpBest-effort context window for a fallback candidate; ``None`` = unknown (never raises; callers pass it through).N)rVrUrzBAuxiliary fallback: could not resolve context window for %s/%s: %s)r|rrrr?rW)rrrVrUctxrcs&&&& r-_candidate_context_windowrPs` &udS#&&373<<  Y[clops : A'A""A' name_modelcV^8dQhR\\\3,R\R\R\\,R\\,R\R\ R\\,/#) r)rrrmin_ctxrBrrQr*)rrXrrrWrm)r,s"r-r.r.sb>> S>>%(>14>?G}> 3-> #>15>c]>r/c HVfR#\Y\VPR4;'gR4\V4;'gRR7pVeWs8dR#V'd\P RWEW'V4M"\P RT;'gRWWV4V RV R V R 2#) zaScreen one fallback candidate by context window; returns the ``tried`` note when it is too small.NrVrj)rVrUzDAuxiliary %s: skipping %s (%s context=%d < min=%d), continuing chainzAAuxiliary %s: skipping %s (context=%d < min=%d), continuing chainr_z (context too small: )r,s"r-r.r.&s_11 1 #1-01JRSV-11.11 8C=(3- ,-1r/c |V'gR#\V4PR4pV'd\V\4'gR#\ WWER7p.p\ V4p \ V4EFwr\V \4'gK\V PRR44P4p V 'gKQ\V PRR44P4p \WPR44pV!WV4'dK\W4'd(\WVR7VPR V R V R 24KT ;'gRpR V R V R 2p\V 4wppVeuV'd\!WVWVR R7MRpV'dVPV4EK;\"P%RYTTT;'g T;'gR4TT;'gTV3u#VPV4EK V'd'\"P'RVRP)V44R# \dRRppLi;i)a1Try auxiliary..fallback_chain entries in order (each needs ``provider``; model/base_url/api_key optional). ``failed_model`` scoping per ``_failed_backend_skip`` (sibling models on the same provider still run after a model-scoped failure). Returns (client, model, provider_label) or (None, None, "").NrjrrrrrVryzfallback_chain[](z ) (unhealthy)rT)rBrrQu9Auxiliary %s: %s on %s — configured fallback to %s (%s)rz=Auxiliary %s: configured fallback_chain exhausted (tried: %s)rr)rGrr?rr rLrrrXrrrrbr_resolve_fallback_entryrrXrr+rr)rBrrr,rrrr!r'rSirr fb_model_raw fb_base_urlrrrr3 too_smalls&&&&$$ r-_try_configured_fallback_chainrb&s  &t , 0 01A BE  5$//  eD E*40Ge$%&& %))J34::<  599Wb1288: -k99Z;PQ  ; 7 7  !+ ; ;  K H LL?1#R }MJ K ''4!!B{m15 3(?(F %I~   +NGe`d%)  Y' KKSoun>e>ePX>e>e\e gn88%? ? U=%>  TVZ\`\e\efk\lm  3(,d~I~ 3sH))H;:H;c V^8dQhR\\,R\R\\\,\\,\3,/#)r)rBrr*r2)r,s"r-r.r.ZsAYY 3-Y*-Y 8C=(3- ,-Yr/cT;'gRP4P4pV'dV'dVR9dR#\WRR7#)uTask fallback_chain when an explicit aux provider cannot build a client (no key/OAuth/pool creds); stops at the per-task chain — the main-agent model stays the runtime last resort.rjzprovider unavailabler>rr)rrrb)rBrexplicits&& r-/_try_configured_fallback_for_unavailable_clientrgZsC  %%2,,.446H x8x#7 )$AW XXr/chV^8dQhR\\\3,R\\,/#r)rrXrr)r,s"r-r.r.es&((4S>(hsm(r/c^RIHpV!V4#)zoResolve inline or env-backed API key via the secret-scope-aware resolver (no raw os.getenv under multiplexing).)resolve_entry_api_key)hermes_cli.fallback_configrj)rrjs& r-rVrVes@  ''r/cV^8dQhR\\\3,R\\\,\\,3,/#r)rrXrrr)r,s"r-r.r.ks5""4S>"eHSM8TW= uyy)//R0668( ##%%aS;-q9-k99Z;PQ f [(K H H LLE7*- .  !'; 7 7  D LLE7,/ 0  3(?(F %I~  *N$>$>hZ_I Y' KKS0I0I65R`RlRldl nn88+E E UA%B  NPTP^P^X^`d`i`ijo`pq Y  KT^^U[]`a8 3 LLOQUQ_Q_Y_afhk l(,d~I~ 3s5I6J J  "JJ J  K &KK c(V^8dQhR\RR/#)r)runtime_providerr*NrW)r,s"r-r.r.s&&#&$&r/c0\'dR#\P!RR4P4pT;'g \ 4pV'dGV'd=VR8wd4VP R4'g\ PRW4RsR#R#R#R#R#)zWarn once when OPENAI_BASE_URL is set but config.yaml names a non-custom provider (a stale ~/.hermes/.env value after `hermes model` poisons routing).NrrjrrzOPENAI_BASE_URL is set (%s) but model.provider is '%s'. Auxiliary clients may route to the wrong endpoint. Run: hermes model to reconfigure, or remove OPENAI_BASE_URL from ~/.hermes/.envT)_stale_base_url_warnedrmrrrrrr)rt _env_base _cfg_providers& r-_warn_stale_openai_base_urlrys +R0668I$==(;(=Mm (A-JbJbclJmJm 2   "&Kn(Am r/c V^8dQhR\\\3,R\\,R\\\\\\3,/#)r)rrBr*r)r,s"r-r.r.sFZZS#XZhsmZcSVX[]`beNeHfZr/c\VPRR4;'g\4;'gR4p\VPR4;'g\4;'gR4p\VPR4;'gR4pVPRR4p\VPR4;'gR4p\ V4'dDV'd<VR 9d5\ VRR7pV'd Ws8wd\ PR WV4TpVR 8Xd%\V4wrV'dV 'dYr2R;p;rVW#WEV3#) zStep-1 target: (provider, model, base_url, api_key, api_mode) of the main runtime, after the fast-model opt-in and the MoA aggregator substitution.rrjrrVrUroT)r,z>Auxiliary task %s: preferring fast model %s over main model %srD>rjr) rXrrrNrIr6rrrK) rrBr"rDrrr8 fast_modelrErFs && r-_main_route_targetr}s J3RR7J7LRRPRSMW[[)EE-=-?EE2FJ7;;z288b9kk)R0O7;;z288b9 %%-MQ]<]0DQ *2 LLY: 7#J$;J$G! Z(5:DF F  F &6IY YYr/cV^8dQhR\R\R\R\R\R\\\\\3,,/#)r)r"rDrrr8r*)rXrrr)r,s"r-r.r.sL-=-=-=$'-=;>-=QT-=hk-= eCcM"#-=r/cV'dV'dVR 9gR#TpT;'gRp\W4pRpV'dVR8XdT;'gRpMVPR4'dkRp \P!\4;_uu_4^RIHp V !V4RJp RRR4V 'dRpM,V'dRpT;'gRpMV'dTpM V'dTp\V4p V 'd \W4'd\WR7R#\YQTY;'gRR7wrV fR#\PRY ;'gT4Y;'gTV3# +'giL;i) zHStep 1: route aux onto the main provider + main model; None if unusable.NrrF_get_named_custom_providerry)r r roz2Auxiliary auto-detect: using main provider %s (%s)>rjr) rrrrrrrrPrrbrCrr+)r"rDrrr8rr health_base_urlr _has_named_entryrmain_chain_labelrr's&&&&& r-_try_main_provider_routersM j],-N%(00D-mOOMX5*22d  ! !) , ,    - - N9-HPTT . !%  !) .66$  .  *-.?@23CUU,G.9J)4L4LF~ KKDmUkUkakl ))z+< <<;. -s E E, cRV^8dQhR\R\\,R\/#)r)r"rBr*rZ)r,s"r-r.r.s&  C x} PT r/cT;'gRP4P4R9dR#\PRT;'gRV4R#)uThe built-in discovery chain is a convenience for installs with NO selected main provider. Once the user picked one, every auxiliary route must be a provider they configured (main, ``auxiliary.``, ``fallback_providers``); guessing "whatever else is logged in" bills an account they never pointed this session at (xAI OAuth session with a dead token → every compression silently charged to a Nous Portal balance).rjTuAuxiliary %s: main provider %s is unavailable and no fallback_chain / fallback_providers is configured — refusing to guess another logged-in provider. Re-authenticate (`hermes model`) or declare a fallback.r_F>rjr)rrrr)r"rBs&&r-rrsK ""$**, < NN !"&..&-A r/c|V^8dQhR\\\,\\,\3,/#r(r)r,s"r-r.r."s(eHV$4hsmS$HIr/c .p\4Fwr\V4p\W4'd#\WR7VP V R24KCV!4wrEVe`V'd2\ P RY;'gRRPV44M \ P RY;'gR4WEV3u#VP V4K \ PRRPV44R#) zJStep 3: hardcoded aggregator/fallback chain, skipping unhealthy providers.ryru4Auxiliary auto-detect: using %s (%s) — skipped: %srrz$Auxiliary auto-detect: using %s (%s)zAuxiliary auto-detect: no provider available (tried: %s). Compression, summarization, and memory flush will not work. Set OPENROUTER_API_KEY or configure a local model in config.yaml.r) rJrrrbrrr+rr)r'rr(r)rrs r-_try_discovery_chainr"s E,. 4U; !% < <  C LLE7,/ 0     R!#5#5Ityy7GI BEK]K]T]^%' ' U/ NNWX\XaXabgXhj r/c V^8dQhR\\\\3,,R\\,R\\\ ,\\,\3,/#)r)rrBr*)rrrXrrr&)r,s"r-r.r.:sJ""4S>*"9A#" 8F Xc]C /0"r/czRs\V4p\VPRR44\ W!4wr4rVp\ W4WVV4pVeV#V'd,\ Y;'gRRR7wrp V eW\V 43#\Y;'gRRR7wrp V eWV 3#\W14'gR#\4#)uFull auto-detection chain, including the selected provider identity. Priority: (1) main provider + main model, regardless of provider type ("auto" means "my main model for side tasks too"; explicit per-task overrides still win); (2) configured fallback policy — task chain, then the main agent's top-level chain; (3) OpenRouter → Nous → custom → Codex → API-key providers, only with no policy and no working main client.Frrjrzmain provider unavailablerer) r,rryrr}rrbrrrrr) rrBrr"rDrVrUroroutedrrrs && r-_resolve_auto_router:s%l3G J ;<=OPW=^:Mx( %mT\ ]F   (F ))62M)O% X  (Eh(OO O$< %%v.I%K!IH,, #M 8 8  !!r/c<V^8dQhR\R\R\/#)r)rrr*r)r,s"r-r.r.Xs!3##r/c\VRR4p\V\4'd V'dV#\T;'gR4#)z@Return the concrete provider selected for an auto-routed client.rlrj)rqr?rX)rrrBs&& r-r>r>Xs: )I2N$c**/A!! x~~2 r/c0V^8dQhR\R\/#)r)rrr.)r,s"r-r.r.ds-.-.-.-.r/cX^RIHp\V\4'dW3#\V\4'd\ V4V3#\V\ 4'd\V4V3#\V\4'd\V4V3#\P!\4;_uu_4^RI HpHp\W4'dV!V4V3uuRRR4#RRR4\!VR4'dW3#\#VP$4p^RIHpHpRV!V4RV/p \-VR4'd\/\144p MY\3V4'd"\/\5VP6VR 74p M'^R IHp V !V4;'gR p \?WlVR R 7p /T ;'g/CV!V4Cp V 'dWR&\AWP6VR7/\CVR R7CV Cp V PER^4V!R/V BV3# +'giEL4;i \<dR p Li;i)ukSync client → async counterpart, preserving Codex routing (``is_vision`` adds the Copilot vision header).) AsyncOpenAI)rAsyncGeminiNativeClientNHERMES_SKIP_ASYNC_WRAP) async_api_keyconfigured_default_headersrUrVrry)_infer_provider_from_urlrjTrrrYr)rrrD)#r2rr?rSrrrArKr_rjrrrrrrr|rXrVagent.auxiliary_async_rebuildrrrr^rs_is_official_codex_base_urlr.rUrrrrrrr) sync_clientrrrrr sync_base_urlrr async_kwargsrSrinferreds &&& r-_to_async_clientrds"+233!!+344(5u<<+788,[95@@+566*;7>>   [ ) )[ k 6 6*;7> * ) 6 *  %=>>!! ,,-M X}[9:}UL]O<<-.>.@A $] 3 3-.G H[H[fs.tu  E/ >DD"H,My^bcL'--RL$>{$KLG*1&'!,=P=P[hia04PaT`aLM1-  & & --E * ) ). H s$+#H9HH H  H)(H)chV^8dQhR\\,R\R\\,/#)r)rrr*r)r,s"r-r.r.s*(3-38TW=r/cZV'gV#^RIHpV!W4# \dTu#i;i)zANormalize a resolved model for the provider that will receive it.)normalize_model_for_provider)hermes_cli.model_normalizerr)rrrs&& r-r7r7s3 K+JAA s  **cjV^8dQhR\\\3,R\R\R\/#)r) custom_entryrrr*r )r,s"r-r.r.s2++S#X+#+TW+\_+r/cVPR4;'gRP4pVPR4;'gVPR4;'gRP4pV'gV'd \V4p\VPRR4;'gR4P4pV'd2^RIHpT!YPPR4;'gT4;'gTpV'Eg%\ P!\4;_uu_4^RI H pVPR 4;'gVPR4;'gTpV!W(4Fp \V 4p \YT4;p eT P4'gK7T P4;p fKM\T R R 4;'g\T R R4;'gRp \T 4P4'gK\T 4P4pM R R R 4T;'gR # \dKi;i +'giL.;i)uCredential for a named custom provider: inline api_key → key_env → key_cmd → credential pool → placeholder. Aux resolves named custom providers here, not via _resolve_named_custom_runtime, so key_cmd must be honoured at the same precedence or every aux call 401s.rUrjkey_env api_key_envkey_cmd)build_command_token_providerr`)#custom_provider_pool_key_candidates provider_keyNrrr)rrrrXagent.command_token_sourcerrrragent.credential_poolrrwrxrrrq) rrrrcustom_key_envcustom_key_cmdrr pool_namepool_keyr pool_entry pool_api_keys &&& r-_named_custom_api_keyrs$'' 288b??AJ"&&y1ZZ\5E5Em5TZZXZaacN .$^4 )))R8>>B?EEGNK1.BRBRSYBZBfBf^fguuku :   + + Q$((8``LH>% H,0%H>+H>H>H>;H>, H; 7H>:H; ;H>> I c V^8dQhR\R\\,R\R\\\,\\,3,/#)r)rr raw_codexr*)rXrrmrr)r,s"r-r.r.sE,,C, ,T,V[\deh\ikstwkx\xVy,r/c$^RIHpHpHpHpHpHpHp ^RIH p T!4'g\PR4R#T!4p Rp \T;'gT T4;'gT p T!T 4'd]RT!4;'gRR T!T 4/pT !T4\R/TBp\PR Y4T'dY3#\!Y4T 3#R T R 2pT!T 4'd2T !T 4p\#TT RTR7p\PRY4Y3#\%Y4p\PRY4Y3# \d\PR4Ru#i;i \d#p\PR T4RuRp?#Rp?ii;i)uAWS Bedrock: Claude → Anthropic Bedrock SDK (prompt caching, thinking); bare in-Region OpenAI IDs → Mantle Responses; everything else, incl. OpenAI ``us.``/``global.`` profiles, → Converse API.)has_aws_credentialsis_anthropic_bedrock_modelresolve_bedrock_runtime_regionbedrock_openai_uses_mantlebedrock_openai_base_urlresolve_bedrock_bearer_token&configure_bedrock_openai_client_kwargs)build_anthropic_bedrock_clientzbresolve_provider_client: bedrock requested but boto3, httpx/openai, or anthropic SDK not installedNzGresolve_provider_client: bedrock requested but no AWS credentials foundz(anthropic.claude-haiku-4-5-20251001-v1:0rUrcrVz0resolve_provider_client: bedrock-openai (%s, %s)rdrez9resolve_provider_client: cannot create Bedrock client: %sr[z3resolve_provider_client: bedrock anthropic (%s, %s)z2resolve_provider_client: bedrock converse (%s, %s)rrD)r\rrrrrrrr4rrrrrr7r&rrAr_)rrrrrrrrrrrrP default_modelr9 client_kwargsrrVrUrcs&&$ r-_build_bedrock_clientrs    K   ^_, -F>M+E,B,B]HM^^Q^K!+.. 35BB /7)  /}=(-( G]#``)=f)RU```)&@H!+.. 8@K*+{I`hi JK`  (< I;_  E {|4  NNVX[ \  s/D:&E":"EE" F-F F Fc V^8dQhR\R\\,R\\\,\\,3,/#r)rrr*rXrrr)r,s"r-r.r.s;3x}xPS}V^_bVcGcAdr/c^RIHpHpT!4'g\P R4R #T!4wrET'd T'g\P R4R #\T;'gRT4p^RIH pT!YER7p\P R T4Y3# \d\P R4R u#i;i \d#p \P R T 4R uRp ? #Rp ? ii;i) zkGoogle Vertex AI: Gemini via the OpenAI-compatible endpoint with an OAuth2 bearer (standard OpenAI client).)rshas_vertex_credentialszGresolve_provider_client: vertex requested but google-auth not installedNzFresolve_provider_client: vertex requested but no GCP credentials foundzTresolve_provider_client: vertex requested but could not mint token / resolve projectzgoogle/gemini-3-flash-previewr%r[z8resolve_provider_client: cannot create Vertex client: %sz$resolve_provider_client: vertex (%s)r) rtrsrrrrrr7r2r&r) rrrsrrrVr9 _VertexOpenAIrrcs && r-_build_vertex_clientrsR " # # ]^')OE mn+E,T,T5TV^_K2u@ LL7E  ' `a QSVWs/B5C"CC C2C-'C2-C2c0a]tRtRtoRtV3RltRtVtR#)_ResolveRequestizYNormalized resolve_provider_client() arguments shared by the per-provider branch helpers.c8<V^8dQh/S[;R&S[;R&S[S[,;R&S[;R&S[;R&S[S[,;R&S[S[S[.S[3,,,;R&S[S[,;R&S[S[S[S[3,,;R &S[;R &S[S[,;R &#) r)roriginal_providerrrrr r rorrrB)rXrrmrrr)r,rQs"r-r._ResolveRequest.__annotate__sM C=    O  }$sXb#g%6677sm4S>**O 3-r/rDNrHrIrJrKrLrrNrOrPs@r-rrscr/rc`V^8dQhR\R\\.\3,,/#r)rrXr)r,s"r-r.r.s(77C7C(2s7*;$;7r/c\V4'd\V\4'gV#\V\4'dVP4#R#)z\A key_cmd/Entra callable passes through uncalled; strings are stripped; anything else is ''.rj)rr?rXrrs&r-rrs9}}ZS11 $S#..399;6B6r/c LV^8dQhR\R\R\R\RR/#)r)seenrrr:r*N)rbrrX)r,s"r-r.r.!s/!!#!C!c!#!$!r/chW9d,VPV4\P!V.VO5!R#R#)zQDebug-log ``msg`` the first time ``key`` is seen so per-call retries stay silent.N)rrr)rrrr:s&&&*r-_log_once_debugr!s(    S 4 r/c<V^8dQhR\R\R\/#)r)reqrVr*)rrXrm)r,s"r-r.r.(s!Ostr/c h^RIHp^RIHp^RIHpV!VP V4'dR#\VP4p\T;'d_V!VPRR4VPRR44;'d.V!V!V44V!V!VPRR4448H4#)rrr)normalize_route_base_urlTrrjrV) rrrrhermes_cli.route_identityrrrrrmr)rrVrrrrs&& r-_is_actual_auxiliary_router(s94Bs||X..%c&6&67G   GKK B7ZQS9T U  $%>x%H I # %gkk*b&A B   r/c TV^8dQhR\R\R\R\R\/#)r)rrxfinal_model_str base_url_str api_key_str)rrrX)r,s"r-r.r.:s8&c&c&cc&cC&c"%&c9<&cr/c\W4'd.\V\4'd VPMTpRVnV#^RIHpV!VPW#4wrxV'dVPVR7Tr0\V\4;'g VP'*;'ddVPR8H;'gMVP'*;'d4\V4R8H;'dRT;'gRP49p V 'dH\PRVP;'gR Y#'d VR ,MR4\W4#VP;'g\VP4p \!WWCV 4#) ueWrap a plain OpenAI client in the right transport adapter; specialized wrappers pass through. Codex (Responses API): explicit ``api_mode=codex_responses``, else — with no explicit api_mode — api.openai.com + codex model. Anthropic (Messages): ``api_mode=anthropic_messages``, any ``/anthropic`` suffix, ``api.kimi.com/coding``, or ``api.anthropic.com``.actualopencode_transport)rorapi.openai.comrrjzeresolve_provider_client: wrapping client in CodexAuxiliaryClient (api_mode=%s, model=%s, base_url=%s)rurt)rr?rrrlagent.opencode_affinityrrrrrorrrr_profile_declared_messages_wirerw) rrxrrrrr_oc_mode_oc_base needs_codexros &&&&& r-_wrap_transportr:sg "#44*&:;;  # #  19- ;+CLL/XHLL(L;X\:34EE    ))    ; ;!,/3CC ; ;O11r88:: <\\44_o\h|TWGXnp r$J@@||LL>s||LH kYa bbr/cFV^8dQhR\R\\,/#rrL)r,s"r-r.r.cs"nncnhsmnr/c^RIHpT!\T;'gR4P4P 44pVeVP R8XdR#R#)zW``"anthropic_messages"`` when the registered profile declares that api_mode, else None.r rjNr,)rr rXrrrors& r-rrcsL."3x~~2#6#<#<#>#D#D#FGG#*#67;K;KOc;c mimmr/c^V^8dQhR\R\R\\,R\/#)r)rrxrr*rrrrX_ResolveResult)r,s"r-r.r.js.'''C'(SV-'\j'r/cZVP'd\WVPR7#W3#)zPReturn (client, model), converting to the async wrapper when ``req.async_mode``.r)rrr)rrxrs&&&r- _route_clientrjs% ~~~ s}}UU  &&r/c vV^8dQhR\R\R\\,R\R\R\/#)r)rrrunavailable_msgr:r*r)r,s"r-r.r.qsIeeeex}e_beknetBer/cVf\P!V.VO5!R#\Y\VP;'gTVP 44#)zpRoute ``client`` on ``req.model or default``; warn and return (None, None) when the provider produced no client.r)rrrr7rr)rrrrr:s&&&&*r-_route_or_warnrqsF ~.. &? @T@TWVYVbVb&c ddr/c0V^8dQhR\R\/#r)rr*rr)r,s"r-r.r.ys''o'.'r/c\VPVPR7wrpVfR#VPpV'd/RV9d(V'd RV9d\P RWB4Rp\ YT;'gT4wrVVeV'd W5nWV3#WV3# \\3d0\P R\T4PT4YV3#i;i)zmAuto: try all providers in priority order; tag the client with the effective provider (survives cache reuse).)rrBNrz\Dropping OpenRouter-format model %r for non-OpenRouter auxiliary provider (using %r instead)z7Auxiliary client %s cannot retain effective provider %sr) rrrBrrrrrlrrr+rH)rrr'rBr routed_client routed_models& r-_resolve_auto_branchrys+>CL\L\cfckck+l(F( ~ IIE (s(/B =>C O"/U=N=Nh"OM %7 K;M 8  &&= && * K LLRm,557I K  && KsB;CCc0V^8dQhR\R\/#rr)r,s"r-r.r.seeOeer/c&\VPVPVPR7wrVf-\P R\ VPR74R#\Y\VP;'gTVP44#)z OpenRouter.)r rr z4resolve_provider_client: openrouter requested but %srr) rr rr rrrrr7rrrrs& r-_resolve_openrouter_branchr sx%s7K7KSVS\S\8;8M8MOOF ~M7ciiH J &? @T@TWVYVbVb&c ddr/c0V^8dQhR\R\/#rr)r,s"r-r.r.s33o3.3r/c (VPp\VP;'gKV\P 49;'g,T;'gRP 4P 4R8HR7wr#Vf\PR4R#\T;'gTTP4p^RI H p\Y$\\VRR4;'gR4\\VRR4;'gR4V!V44p\!WV4#) zNous Portal (OAuth).rjz mimo-v2-omnir(zYresolve_provider_client: nous requested but Nous Portal not configured (run: hermes auth) nous_api_moderUrVr)rr0rrNrrrrrr7rrr rwrXrqr)rrrrr9r s& r-_resolve_nous_branchr s IIE )[)[BYB`B`Bb9b)[)[,1KKR+>+>+@+F+F+HN+Z]OF ~rs+E,<,>o>.>r/c dVPpV'g\PR4R#RpVP'dZ\ 4wr4V'g\PV4R#\ W4\ W4R7R7pV\WP43#\V4wrg\WWr4#)u'OpenAI Codex (OAuth → Responses API).zresolve_provider_client: openai-codex requested without a model; pass model explicitly (e.g. model.model in config.yaml or auxiliary..model for per-task aux routing).zbresolve_provider_client: openai-codex requested but no Codex OAuth token found (run: hermes model)ryrr) rrrrrrr.r7rr0r)rr no_token_msgr/rV raw_clientrrs& r-_resolve_openai_codex_branchr s IIE N OwL }}} B D  NN< ( *;;TU`;tv 4ULLIII)%0OF #w ==r/c0V^8dQhR\R\/#rr)r,s"r-r.r.snn?n~nr/cJ\VP4wr\WVR4#)uxAI Grok OAuth (device code → Responses API). Without this branch xai-oauth falls to the generic oauth_external arm, returns (None, None), and silently re-routes every aux task to the Step-2 fallback.uresolve_provider_client: xai-oauth requested but no xAI OAuth token found (run: hermes model -> xAI Grok OAuth — SuperGrok / Premium+))r(rrr s& r-_resolve_xai_oauth_branchr s-2#)){KM '6# $&YzYKYSXY fk;S;S U_`S&+66()BC (  3E4D4DWhOK  26I#I..z)S7Q7QBX[\e\k\kikXlE$S&+s76S]_aCbChChfh?ikpqF fk: :D NNef r/c tV^8dQhR\R\R\\\\3,,/#)r)rrrZr)r,s"r-r.r.s9 U U# U3 UW_`dehjmem`nWo Ur/c\\V44wr4V'dRV/M/p\R4pV'd/T;'g/CVCpV'dWeR&\RRVRV/VB#)a Plain OpenAI client on the /v1 equivalent of a named custom entry's base URL. ``extra_headers`` is the entry's own header block (gateway routing tags, proxy auth): the main runtime lifts it onto every request, so aux must too (#109595). SECURITY: never log the values.rNrYrUrVrD)rrr^r)rrrZrrr _headerss&&& r- _named_custom_openai_wire_clientr sk 11D[1QRK'*os #F*40H8x~~28-8$, ! T Tk TV TTr/cFV^8dQhR\R\\,/#r)rrr)r,s"r-r.r.$s#K3K3oK3(>:RK3r/c H^RIHpVPpRpVP'd$VPV8wdV!VP4pVf V!V4pV'gR#VP;'gVP R4;'gRP 4p\VP4;'g \W2V4pVR8Xd0\PRVP R4;'gT4VP;'gVP R4;'gRP 4p\W4'd^R IHpV!V4pR pV'g\PR V4R#^R IHpV!VP R 44p \%VP&;'geVP R4;'gLVP('dVP(P R4MR;'g\+4;'gRT4p ^RIHp V !W*V4wrV 'dYrF\P1RY*T;'gR 4VR8XdP^RIHp^RIHpV!WT4pV 'dVP;V R7p\?T\CTYTT!YE4R7T 4#\AWEV 4pVR8Xd\EVV 4pM\GVVWV4p\?VVV 4# \<d1\PRT4\?T\AYET 4T 4u#i;i)zeNamed custom provider (config.yaml providers dict / custom_providers list); None if no entry matches.rNrVrjruresolve_provider_client: named custom provider %r has no resolvable api_key — request will be sent with placeholder no-key-required and will 401 on auth-required endpointsr`rorr`zAresolve_provider_client: named custom provider %r has no base_url)normalize_extra_headersrZrrrzCresolve_provider_client: named custom provider %r (%s, api_mode=%s)r,rrr)rYuNamed custom provider %r declares api_mode=anthropic_messages but the anthropic SDK is not installed — falling back to OpenAI-wire.rvrr)$rrrrr rrrr rrrrorrrrr r7rrrOrrrr4rsrr with_optionsrrr rArr)rrrrrrentry_api_moderr entry_headersr9rrrrsrrUrs& r-_resolve_named_custom_branchr$ $sF||HL !6!6(!B1#2G2GH 1(; ((NNL,<,\r/c\VPVPVPVPR7wr\ WVR4#)zAzure Foundry via the runtime resolver: the generic PROVIDER_REGISTRY path only knows the static AZURE_FOUNDRY_API_KEY env var, missing ``auth_mode: entra_id`` (callable bearer) and config base_url overrides.)rr r rozsresolve_provider_client: azure-foundry requested but runtime resolution failed (run: hermes doctor for diagnostics))r:rr r ror)rrrs& r-_resolve_azure_foundry_branchr' rsL/SYYQTQeQeADAVAVadamamoF #}[ \\r/cJV^8dQhR\R\R\R,/#)r)rrr*Nra)r,s"r-r.r.|s&sSSSWZr/c ^RIHpV!V4pTfR#TP!R/TB# \dR#i;i \d\P RTRR7R#i;i)uRegistered profile's own client for an ``api_key`` aux route, or ``None``. Same registration seam as ``agent_runtime_helpers._provider_supplied_client`` (main agent) and the ``external_process`` branch below: a profile whose wire protocol is not OpenAI-over-HTTP overrides ``ProviderProfile.create_client()`` to supply its transport. A profile that raises is logged and skipped — a third-party plugin can only fail to provide a client, never take the auxiliary resolution down.r Nz{resolve_provider_client: provider profile %r failed to create an auxiliary client; falling back to the standard client pathTrrD)rr r create_clientrr)rrr r3s&, r- _api_key_profile_supplied_clientr+ |s|2&x0$$5}55  T$  0 s); 88#A"!A"cHV^8dQhR\R\R\R\/#)r)rr resolve_credsr*)rrrr)r,s"r-r.r.s)<3<3<33<3x<3\j<3r/cVPpVR8Xd1\VPVPR7wrE\ WVR4#V!V4p\ VP RR44P4p\VP4;'gTp\ VP RR44P4PR4;'g VPpVP'd*VPP4PR4pVR8XdV\P!\4;_uu_4^R IHp Hp Hp V !V4pV'gV !V4'dT pR R R 4V'gO\%VP&4VR 8XdR .M.,p \(P+R VRP-V 44R#\/V4p VP'd:VR8wd3\/VPP4PR44p \1VP2;'g \5V4V4p\7W7V R7pVe#\(P+RW>4\9WV4#VR8XdB^RIHpHpV!V 4'd,V!W}R7p\(P+RW>4\9WV4#\AWVPBRR7p\ERRVRV /V'dRV/M/BpVR 8Xd{V'dsVPF'ga\P!\H4;_uu_4^RI%H&pV!V4'd"\(P+RV4\OWN4pR R R 4\QWWV4p\(P+RW>4\9WV4# +'giELD;i +'giLS;i)zgPROVIDER_REGISTRY ``api_key`` providers (Anthropic via its own resolver), honouring explicit overrides.r<)r r zOresolve_provider_client: anthropic requested but no Anthropic credentials foundrUrjrVrr)ACTUAL_LOCAL_NOAUTH_PLACEHOLDERis_actual_local_base_urlrNrz gh auth tokenzJresolve_provider_client: provider %s has no API key configured (tried: %s)rr[zDresolve_provider_client: %s native client from provider profile (%s)r7r resolve_provider_client: %s (%s)TrrY)!_should_use_copilot_responses_apiudresolve_provider_client: copilot model %s needs Responses API — wrapping with CodexAuxiliaryClientrrD))rrr r rrXrrrr rrrrrr/ r0 rrapi_key_env_varsrrrrr7rr6r+ rrrrrrrrrrr2 rr)rrr- rrrr&rUrr/ r0 r tried_sourcesrVr9profile_clientrrrSr2 s&&& r-_resolve_api_key_branchr6 s||H; .@T@TADAVAV!Xc=oq q ( #E%))Ir*+113G!!5!56AA'GuyyR01779@@EccIcIcL ,,224;;C@ 8   + +  5\BL7 EE9 , W556x[dOd?:Kjlm  atyy7 9"<0H X!5&s'<'<'B'B'D'K'KC'PQ+CII,^,^9TU]9^`hiK5hZbcN! []esS+>>8] $X . .'KF LL;X S k: :'cmmY]^G " {7 {X {jqK\^eJfwy {F9S]]]   - - K0== TU`b-fB .S+W MF LL3XK k 22W, + +B. -s(N*-N*=6N>* N; > O c^V^8dQhR\R\\\3,R\/#)r)rr&r*)rrrXrr)r,s"r-r.r.s*%%/%$sCx.%Uc%r/c VPp\VP;'gBVP'dVPP R4MR;'g \ 4T4p^RIHpV!V4pVEe)\VP RR44P4p\VP RR44P4pV'g\PRV4R#V'd V'g\PRV4R#TPYg\VP R R44P4;'gR\VP R 4;'g.4R 7pVe#\PRW#4\!WV4#\#\$VRV4R# \dRpELQi;i \d\PR TR R7RpLui;i)zVPROVIDER_REGISTRY ``external_process`` providers, served via their registered profile.rNr rUrjrVzMresolve_provider_client: %s requested but no model was provided or configuredzUresolve_provider_client: %s requested but external process credentials are incompletecommandr:)rUrVr9 r:zOresolve_provider_client: profile %r failed to create an external-process clientTrr1 zLresolve_provider_client: external-process provider %s not directly supportedr)rr7rrrrOrr rrXrrrr* rrrr _LOGGED_UNSUPPORTED_EXTPROC_KEYS) rr&rr9_get_provider_profile_extproc_profilerUrVrs && r- _resolve_external_process_branchr= s||H+ pps7G7G7Gc&&**73TppVnVpK  K0:#eii 2./557uyyR01779 NNjlt u h NNrt| }  %33EIIi45;;=EEDQVQZQZ[aQbQhQhfhLi4kF   LL;X S k: :4h)*24 3     NNl#d  4F s0-F<;GG6 G< G  G %G87G8c0V^8dQhR\R\/#rr)r,s"r-r.r.s/nr/cVPp^RIHpHpHpTPT4pTf\\TRT4R#TPpTR8Xd \YT4#TR8Xd\Y!T44#^RIHpTPT4pTe T!T4#\\ Ya3RYa4R# \ d\ PRT4Ru#i;i) zUPROVIDER_REGISTRY providers, dispatched on ``auth_type``; unknown providers log once.)rr-resolve_external_process_provider_credentialsz-hermes_cli.auth not available for provider %sz,resolve_provider_client: unknown provider %rrUexternal_process)REGISTRY_AUTHTYPE_ARMSz6resolve_provider_client: unhandled auth_type %s for %sr)rrrrr@ rrrrr_LOGGED_UNKNOWN_PROVIDER_KEYSrr6 r= agent.auxiliary_client_registryrB _LOGGED_UNHANDLED_AUTHTYPE_KEYS) rrrrr@ rrrB arms & r-_resolve_registry_branchrG s||H   ##H-G5xF R!!II&s5YZZ&&/5bck5lmmF $ $Y /C 3x3i5JL) +  DhOs B00#CCrcV^8dQhR\R\R,R\R\R\R,R\\\.\3,,,R\R,R \\\\ 3,,R \R \\,R \ \\ ,\\,3,/ #) r)rrNrrr r rorrrBr*)rXrmrrrrr)r,s"r-r.r.'sV)V)V)*V)9=V)RVV)TzV)VR8wd7VR8Xd V'g(\V4;'g\4;'gTp\W WVWEWgW4 p\P!V4pV P#R 4pVe V\$9d\'V4pVeV#Ve V!V4#VR 8Xd \+V4#\-V4# \(dRpL>i;i) ubCentral router: return a configured client (auth, base URL, API format) for a provider + optional model. The client always exposes ``.chat.completions.create()``; Codex/Responses providers get an adapter. ``provider``: built-in name, ``custom:``, "custom" (OPENAI_BASE_URL + OPENAI_API_KEY) or "auto" (full auto-detection chain). ``model=None`` → provider's default aux model. ``raw_codex`` → bare OpenAI client for ``responses.stream()`` callers. ``api_mode`` forces "codex_responses"/"chat_completions"/ "anthropic_messages" instead of auto-detect. Returns (client, resolved_model) or (None, None).rjNrDzmoa://bare_llamacpp_endpointzNresolve_provider_client: %s requested but no local llama.cpp server is runningrrrr5r)rrrrr~rXrKragent.auxiliary_local_runtimerK rrr6rOr_EXPLICIT_PROVIDER_BRANCHESr removeprefixrr$ rr' rG )rrrrr r rorrrBrrErFrK rrbranchalias_identityr_s&&&&&&&&&& r-rCrC's"R..0668&x0H"3x~~2#67==?GG4H5$;E$B! Z - 3 3 5 ; ; = .}=HE S):%;%A%A%C%N%Nx%X%X$(!#' D "#4IY ZE Qxx NNkm~  .3+ X'V1C 0,H5\\9Q9S\\W\ U XY C) , ,X 6F&33I>N~+@@ 1#6F  M c{?",S11 #C (( F s H HHc V^8dQhR\R\\\\3,,R\\\ ,\\,3,/#)r)rBrr*)rXrrrrr&)r,s"r-r.r.s\CxSRUX?Wchiqrxiy|DEH|IjIdJr/c P\T;'gR4wr#rEp\W#WEWaR7#)ziReturn (client, default_model_slug) for text-only aux tasks; ``task`` selects auxiliary. overrides.N)rr r ror)_resolve_task_provider_modelrC)rBrrrrVrUros&$ r-get_text_auxiliary_clientrT s23OPTP\P\X\3]0HX " r/ deepinfracRV^8dQhR\R\\,R\/#rrZ)r,s"r-r.r.s% 8 8# 8hsm 8 8r/c^RIHp^RIHpT!YT!44pTfR#\ T4# \dR#i;i \ dR#i;i)upTrue when ``provider``/``model`` is known to accept image input; unknown capability → True (attempt the call).)_lookup_supports_visionrbT)agent.image_routingrX rrrrrm)rrrX rsupportss&& r-rBrBs_?:*8aNr/cT;'g \R4pV'g\PR4R#\RVRR7#)ziDeepInfra vision: default model is discovered live via default_vision_model() so no hardcoded id can rot.rU ubVision auto-detect: deepinfra catalog unreachable or returned no vision-tagged models — skippingTrr)rQrrrC)r vision_models& r- _deepinfra_strict_vision_backendra s:II<[IL  yz ";  MMr/c\RVRR7#)rTrrCrs&r-rrs4YQUVr/c\VR7#)r)rrs&r-rrs e BlBr/c:V^8dQhR\\,/#r(rrX)r,s"r-r.r.stCyr/c`.p\4pV'd^VR9dWV\9d\V4^,RJpM\V\ 44^,RJpV'dVP V4\F2pW09gK \V4^,fK!VP V4K4 V#)uAvailable vision backends in auto-selection order (active provider → OpenRouter → Nous → DeepInfra). Single source of truth for setup, tool gating, and runtime auto-routing. N>rjr)r_VISION_AUTO_PROVIDER_ORDERrm rCrNr) availabler"main_okrOs r-get_available_vision_backendsrt s I')Ml: 7 74]CAFdRG-m=M=OPQRS[__G    ] + ( "@"CA"F"R   Q ) r/cV^8dQhR\R\R\\,R\\,R\R\\\,\\,\\,3,/#)r)rrrr3rr*)rXrrrmr)r,s"r-r.r.s^ 7 7 7), 7=Ec] 7SM 7/3 7 8C=(3-# 67 7r/cjVfVRR3#T;'gTpV'd\WRR7wrgWV3#WV3#)zSApply the explicit model override (and async wrapping) to a resolved vision client.NTr)r)rrrr3rr9 async_client async_models&&&&& r-_finalize_vision_clientry sM  $,, 11MK$4[Y]$^!  ;; ; 66r/cV^8dQhR\R\R\\\3,R\\,R\\,R\\\,\\,3,/#)r)r"rDrr3r6r*)rXrrrr)r,s"r-r.r.sb-1-1-1$'-126sCx.-1RZ[^R_-1}-1 8C=(3- '(-1r/c @\V4pT;'gTpVR8XdK\Y;'gT4wrxVfR #\PRY;'g T;'gT4Wx3#V\9d\P RV4R #\ W4'g\P RV4R #R;rTp VR8XgVPR4'dVPR4'd>VPR4VPR 4;'gRVPR 4rp M \4wrpV 'dYrT;'g T;'gRp \WWWR R 7wppVfR #\PRTT;'gT4TT;'gT3#)z^Auto-detect step 1: try the main provider; (None, None) falls through to the aggregator chain.rNz/Vision auto-detect: using main provider %s (%s)uiVision auto-detect: skipping main provider %s (no vision support) — falling through to aggregator chainutVision auto-detect: skipping main provider %s (reports no vision capability) — falling through to aggregator chainrrrVrUroT)ror r rrr) rQrm rr+rArrBrrrrC)r"rDrr3r6provider_vision_defaultr` rr rpc_base_url rpc_api_key rpc_api_moderrr rpc_client rpc_models&&&&& r-_vision_main_provider_clientr s?}M*88jL&DMS|S|e|%}"    E}WDWDguWDWDzD E))11 ACP Q &} C C  C  "&%L$L M$<$rjrDrr)rXrrrNrrrKrr ry rq rm rr) rr3r6rr"rDrErFrrrrs &&&& r-_vision_auto_router s   J/HH3F3HIMW[[)??-=-?@J""$-%**L 8C=(3-# 67 *Lr/c \V4p\RWW#4wrxrp T\V4r|V 'd0V'd VR 9dTMRp \WVWWR7wrYVeV3#R3#VR8Xd \ WhW4#V\ 9d\ Wx4wpp\VVVW4#VR8Xd?\F4p\YxTTT ;'gRRVRR 7wrVfK'\W~WV4u# \WWKVRR 7wrY~VeV3#R3#) zResolve the client actually used for vision tasks. Direct endpoint overrides beat provider selection; explicit providers may force experimental backends; auto mode only tries backends known to work. rrr)rrr r rorNr8r`T)rVrUrorr)rorr>rjr) rrS r] rCr rq rm ry _ZAI_OPENAI_VISION_URLSr=)rrrVrUrrrrr3r4r5r6 raw_requestedprovider_for_base_overriderr9rr_zai_urls&&$$$$ r-r<r<0sF&l3GXt(8YUI0DU )*DY*O92; Q]@]Yck"5 &/&  *6CUK``[_``F!';LYY//%CI%^" ]&y+}niiE/H"4:(00D;M\c# F !.y+_ijj0-z\cosF f.@{ KKd KKr/c$V^8dQhR\/#r(rT)r,s"r-r.r.]s;;$;r/c2\'d \4#/#)zNReturn extra_body kwargs (Nous Portal product tags when Nous-backed, else {}).)r,rrDr/r-get_auxiliary_extra_bodyr ]s!2!2  ::r/cRV^8dQhR\R\\,R\/#)r)rQrr*)rWrrXr)r,s"r-r.r.bs% ! !c !Xc] !d !r/c\\44;'gRp\R4'*;'d3\4RJ;'dVR9;'gVP R4pV'g\ V4'dRV/#RV/#)zMax-tokens kwarg for the auxiliary provider: direct OpenAI/Copilot and newer OpenAI-family models (by ``model`` name, so custom endpoints fronting gpt-5.x are caught) need max_completion_tokens.rjrNz.githubcopilot.comr$r#)rapi.githubcopilot.com)rrrrrr)rQr _custom_hostdirect_openai_familys&$ r-auxiliary_max_tokens_paramr bs%%=%?@FFBL 0 11 y yo6G46O y y H H w wLLaLabvLwA%HH'// %  r/cpa]tRtRtoRtR tV3RlRltV3RlRltV3RlRltV3R lR lt R t Vt R #) _CallableCacheDiscriminatori|zBHash a credential callback by identity without exposing its state.c$<V^8dQhRS[RR/#)r)rZr*Nr9)r,rQs"r-r.(_CallableCacheDiscriminator.__annotate__s""""r/cWnR#r8 _callback)r9rZs&&r-r\$_CallableCacheDiscriminator.__init__s!r/c <V^8dQhRS[/#r(r)r,rQs"r-r.r s""#"r/c,\VP4#r8)r2r rEs&r-__hash__$_CallableCacheDiscriminator.__hash__s$..!!r/c&<V^8dQhRS[RS[/#)r)otherr*)rrm)r,rQs"r-r.r sddFdtdr/cb\V\4;'dVPVPJ#r8)r?r r )r9r s&&r-__eq__"_CallableCacheDiscriminator.__eq__s(%!<=cc$..TYTcTcBccr/c <V^8dQhRS[/#r(rW)r,rQs"r-r.r s$$#$r/cR#)zrDrEs&r-rF$_CallableCacheDiscriminator.__repr__s#r/r N) rHrIrJrKrLrMr\r r rFrNrOrPs@r-r r |s7LI""""dd$$r/r c<V^8dQhR\R\R\/#)r)r8rQr*ra)r,s"r-r.r.s!CCr/cVR8Xd\V4'd \V4#VR8XdV\V\4'd@V'd8R\P !VP R4^R7P43#V#)z;Return a hashable, secret-safe runtime cache-key component.rUzapi-key-digestrr)rr r?rXrrrr )r8rQs&&r-_runtime_cache_discriminatorr sa huoo*511 j44 '//%,,w2GUW"X"_"_"abb Lr/rBc6V^8dQhR\R\R\\,R\\,R\\,R\\\\3,,R\R\\,R \\,R \ / #) r)rrrVrUrorrrBrr*rXrmrrrr)r,s"r-r.r.sQQQ"&Q2:3-Q c]Q-5c]Q4S>*Q?CQ 3- Q(0} Q  Qr/ca\V4oVR8Xd;\;QJd.V3Rl\4FNK 5M!V3Rl\44MRp VR8XdT;'gR\V43MRp \ WR7p T;'gSP RR4p \ RT;'gR4p \4YT;'gRY;'gRWWV \WVS43 #)rc3\<"TF!p\VSPVR44xK# R#5i)rjN)r r)r#r$rs& r-r%$_client_cache_key..s*jUiPQ4Q Ar8JKKUis),rjrrrUrD) rrrrIrrr r_borrowed_main_credential_key)rrrVrUrorrrBr runtime_keytask_key pool_hint model_key api_key_keyrs&$$$$$$$$ @r-_client_cache_keyr s &l3Gnv{AoA%%jUij%%jUijjGIK?G6?Q 4T:;WYH EI11Wb1I.y'--RHK  xX^^[R`R`^`bm{CPY )(gw O QQr/c V^8dQhR\R\\,R\R\\\3,R\/#)r)rrVrUrr*)rXrrrr)r,s"r-r.r.sI@@C@8C=@SV@aefiknfnao@ty@r/c\V4R8wdR#V'g/VPRR4\RVPRR443#\V4'dR#\ \ V4P 44p\RV43#)a What a keyless ``custom`` route borrows from the main runtime when its client is built. The client keeps that credential for its lifetime, so it joins the cache key: otherwise a later runtime (another session, a ``/model`` switch) is served the earlier one's key. rrVrjrUrD)rrr rrWrr)rrVrUrborroweds&&&& r-r r s x(H4  J+-I)U\U`U`ajlnUo-pqq'"" 01DX1N1T1T1VWH (H = ??r/c$V^8dQhR\/#r(r9)r,s"r-r.r.sSr/cP^RIpVP4# \dR#i;i)z\``asyncio.get_event_loop()`` or None when no loop can be obtained (async cache-key binding).N)rget_event_looprc)_aios r-_current_event_loopr s+""$$ s  %% bound_loopc bV^8dQhR\R\R\\,R\RR/#)r)rrrr r*N)rrrrX)r,s"r-r.r.s=GGEG3GxPS}GehGtxGr/c\V\4'dR#\;_uu_4\P V4pVe V^,VJd\ V^,4WV3\V&RRR4R# +'giR#;ir8)r?rSrrr_close_cached_client)rrrr old_entrys&&&$ r-_store_cached_clientr sd&-..  !%%i0  Yq\%? 1 .$*:#F i    s AA55 B lookup_model lookup_taskcV^8dQhR\R\\,R\R\\,R\\,R\\,R\\\\3,,R\R \\,R \\,R \ \\,\\,3,/ #) r)cache_providerrrrVrUrorrr r r*)rXrrmrrr)r,s"r-r.r.s$$$#+C=$>B$NVWZm$ c]$-5c]$4S>*$?C$3- $6>c] $  8C=(3- '( $r/c \RVR7p V fRV3#V wr\WR7p V'd \4MRpV'd\Y;'gRVR7wppMYpp\ WW4WVWyVR7 p\ VVVVR7VV3#) umRefresh Nous runtime creds, rebuild the client, and replace the cache entry. ``model`` is the resolved wire model stored as the entry's usable model and returned. The cache KEY MUST be built from ``lookup_model``/``lookup_task`` — the model and task as passed to ``_get_cached_client`` when the stale client was acquired — so the fresh client overwrites the exact entry the stale one is served from. Keying on the resolved model or an empty task would leave the expired client immortal and every auxiliary call 401ing forever. See #56889. For ``provider == "auto"`` the task participates in the cache key (task-specific fallback policy), so it MUST be carried into the key here for the same reason as ``lookup_model``; otherwise an auto-provider client refreshed on a 401 lands under the ``task=""`` key while the stale entry survives under the task-scoped key (#58894). T)rrNr[rjrrrVrUrorrrBr)r )rrr rr r )r rrrVrUrorrr r r fresh_keyfresh_base_urlr current_looprr9rs$$$$$$$$$$ r-_refresh_nous_auxiliary_clientr s((dwWGU{ 'I' SK,6&(DL.{KKRS\] ) ! I FKLQ ; r/cV^8dQhRR/#rrD)r,s"r-r.r.s     r/cT^RIHpRVnR# \\3dR#i;i)aMonkey-patch ``AsyncHttpxClientWrapper.__del__`` to be a no-op. The SDK's ``__del__`` schedules ``aclose()`` on the *running* loop, but the transport is bound to the loop the client was created on; when that loop is dead this raises "Event loop is closed" into prompt_toolkit's loop. Safe because cached clients are closed explicitly and the OS reaps the rest. Call once at CLI startup, before any ``AsyncOpenAI`` is created. AsyncHttpxClientWrappercR#r8rDrEs&r-r(neuter_async_httpx_del..str/N)openai._base_clientr __del__rrr s r-neuter_async_httpx_delr s* ?*;'  (   s ''c(V^8dQhR\RR/#)r)rr*Nr9)r,s"r-r.r.s..S.T.r/c\P!\4;_uu_4^RIHp\ VRR4pVe%\ VRR4'gVP VnRRR4R# +'giR#;i)uMark the httpx AsyncClient inside an AsyncOpenAI client as closed so ``__del__`` won't schedule ``aclose()`` on a dead loop. Skips the full async close — the OS drops connections.) ClientStaterN is_closedT)rrr httpx._clientr rqCLOSED_state)rr inners& r-_force_close_async_httpxr sV   Y ' '- 40  WUK%F%F&--EL ( ' ' 's .__annotate__s---r/c<"SGRjxL \S4R#L \dLi;i \S4i;i5ir8)rr )rr sr- _await_close+_schedule_async_close.._await_closes? -   %V ,     %V ,s0? ? ,/,/ <?NcV^8dQhRR/#rrD)r,s"r-r.r $s / /D /r/c\P!\4;_uu_4VP4RRR4R# +'giR#;ir8)rrrar`)completed_tasks&r-_consume'_schedule_async_close.._consume$s.((77",,.8777s > A ) rget_running_loop create_taskadd_done_callbackrcrrrrrrr )r rr runnerr looprBr sff r-_schedule_async_closer s--^F) ((*D##F+D /  " "8 ,F  HHV   )  $$Y// 0/// ( )sKA9A*A9A62A95A66A991C&*C; C& C C&%C& close_asyncc4V^8dQhR\R\RR/#)r)rr r*Nr)r,s"r-r.r.0s!%%%d%t%r/cVfR#\VRR4p\V4'g\V4R#V!4p\P !T4'd^T'd\ Y04R#\P!\4;_uu_4TP4RRR4\T4R#\T4R# \d\T4R#i;i +'giLG;i)zBClose one cached client, awaiting async transports only when safe.Nr) rqrr rinspect isawaitabler rrr)rr rGr s&$ r-r r 0s ~vw-H H   (z <((  !, 7 $$Y//""$0 $V ,V$  (0/sC CCC C- cV^8dQhRR/#rrD)r,s"r-r.r.Js>>>r/c\;_uu_4\P4Uu.uF!q^,fKV^,V^,3NK# pp\P4RRR4^RIpVP 4pXF8wrEVRJ;'dVP4;'gWSJp\WFR7K: R#uupi +'giLj;i \ dRpLgi;i)zClose all cached clients; call at CLI shutdown *before* the loop closes. Snapshot+clear under the lock, close outside it: async teardown can block while an owner loop drains, and holding the lock would convoy every caller. Nr ) rrrrerr rcr r )rclientsr running_loopr owner_loopr s r-shutdown_cached_clientsr Js  5B5I5I5Kd5KEUVx'E!HeAh'5Kd ,,. &!,gg*2F2F2H2f2fJLf V= &e    s3C CC C,CC C  C('C(cV^8dQhRR/#rrD)r,s"r-r.r._s77T7r/c p\;_uu_4\P4UUu.uF;wrV^,fKV^,P4'gK1W^,3NK= pppVF wr\VK RRR4XFwrE\ VRR7K R#uuppi +'giL0;i)zForce-close cached async clients whose loop is closed; call after each agent turn (defense-in-depth behind ``neuter_async_httpx_del``).NTr )rrrr r )rrr4r_keyrs r-cleanup_stale_async_clientsr _s  3@3F3F3Hz3HZSERSHejklemewewey#Qx3Hz!LCc""  V6{  s'B%B B B (B%B%% B5 c V^8dQhR\R\\,R\\,R\\,/#)r)rrcached_defaultr*r)r,s"r-r.r.js7 # ## #hsm #Xc] #W_`cWd #r/c XV'dRV9d\;QJd5RV\VRR4\VRR434F 'gK RM* RM&!RV\VRR4\VRR4344;'g\T;'dRV94pV'gV#T;'gT#)zKeep slash-bearing model IDs only for cached clients that accept ``vendor/model`` (OpenRouter or a slash-bearing default). Mirrors the resolve_provider_client() guard, which cache hits skip.rc 3"TF9pT;'d+\\\VRR4;'gR4R4xK; R#5i)rVrjrN)rrXrq)r#r@s& r-r% _compat_model..nsA b  c c)#gc:r.J.P.Pb*QSbc cbs A3ArNrTF)r3rqrm)rrr accepts_slashs&&& r- _compat_modelr js   4 @'&RZ\`Bab   4 @'&RZ\`Bab  <<.::SN%: ; ! !  " "N"r/cdV^8dQhR\R\R,R\R\R,R\R,R\R,R\\\\3,,R \R \\,R \ \\,\\,3,/ #) r)rrNrrVrUrorrrBr*r )r,s"r-r.r.wsH?H?H?*H?9=H?QTW[Q[H? 4ZH?*-*H?KSTXY\^aYaTbKcH?H?$,C=H? 8C=(3- '( H?r/c ^RIHp V !WV4p V eV ^,'gR#V wr4V'd \4MRp \V4p \ WW4VWgWR7 p \ ;_uu_4V \ 9d\ V ,wrpV'*;'g.VRJ;'d"VV J;'dVP4'*pV'dV\WV43uuRRR4#\TVRJ;'dVP4R7\ V RRR4TpV'gA\V\V4R4pVe&\VV4;pe\V4;'gTp\WW#VW\WxR7 wppVe\4'dTT;'gT3#Ve\ ;_uu_4V \ 9dE\!\ 4\"8d \ \%\'\ 44K7VVV 3\ V &M Tp\ V ,wppp\VVR7RRR4V\VVV43# +'giEL);i +'giL3;i)aGet or create a cached client for the given provider. Async clients bind to the loop they were created on, so every async hit validates the cached loop is the current, open loop; stale entries are replaced in place (bounded, no cross-loop reuse). This keeps cache size bounded to one entry per unique provider config, preventing the fd-exhaustion that previously occurred in long-running gateways where recycled worker threads created unbounded entries (#10200). rJ Nr r c\VR4#)r)r)rs&r-r$_get_cached_client..s]xyz}F^Gr/)r r rorrrBr)rL rK r rr rrr r r ryrrrrCrsr_CLIENT_CACHE_MAX_SIZEnextiter)rrrrVrUrorrrBrK rr rr cached_clientr cached_looploop_okeffective_api_key_pool_perr built_clientrs&&&&&&&&& r-r=r=ws5 E "8w ?E Qxx !,6&(DL%l3G!(V^!TI    %9Fy9Q 6M;$n4'ggK<,GggP[PePePgLg $mM.&YY   !Kt&?@,2M<+P i(% +8+C( q$\zJ  = > >>Y   @ s=&)H, H, H,(H, H,H,/H,%A0I, H= I c V^8dQhR\R\\,R\\\\,3,/#)r)provmdlr*rXrr)r,s"r-r.r.s3s#5hsmAS;Tr/cVP4P4R8wdW3#\V4wr#V'd V'dW#3#W3#)zResolve an *explicit* ``provider: moa`` to its preset's aggregator slot (_resolve_auto_route() only unwraps the implicit case; "moa" isn't in PROVIDER_REGISTRY and would dead-end).rD)rrrK)r r rIrJs&& r-_unwrap_moa_providerr sF zz|u$y5c:L && 9r/cFV^8dQhR\\,R\/#)r)r r*r)r,s"r-r.r.s8C=Tr/c\T;'gR4P4P4pVR9gVPR4'dR#V\9dR#\ V4'dR#\ V4'dR#R#)zSTrue when a first-class provider keeps its identity alongside an explicit base_url.rjrFT>rjrr)rXrrrr_builtin_provider_present_named_custom_provider_present)r rs& r- _preserve_provider_with_base_urlr% slTZZR&&(..0J++z/D/DY/O/O** !,,%j11 r/c0V^8dQhR\R\/#r_r.)r,s"r-r.r.s  C D r/cP^RIHpV!V4RJ# \d TR9u#i;i)aLook up *name* in the built-in provider registry, returning False (not raising) when the catalog fails to load. Used by ``_preserve_provider_with_base_url`` so a built-in lookup exception cannot suppress the parallel user-defined provider lookup (#76602). ) get_providerN>rrr<r qwen-oauth copilot-acpr minimax-oauth)rr( r)r`r( s& r-r# r# s= 5D!--        s %%c0V^8dQhR\R\/#r_r.)r,s"r-r.r.sr/cH^RIHpV!V4RJ# \dR#i;i)uJLook up *name* in the user-defined ``providers:`` section of config.yaml, returning False when the config is unavailable or fails to load. Used by ``_preserve_provider_with_base_url`` so a user-defined provider remains preserved even when the built-in registry raises (parallel lookup; each side fails independently — #76602). rNF)rrr)r`rs& r-r$ r$ s.J)$/t;; s  !!cNV^8dQhR\R,R\R,R\R,R\\,R\\,R\\\\,\\,\\,\\,3,/#)r)rBNrrrVrUr*r )r,s"r-r.r.sJAJA *JA'*TzJAADtJA^fgj^kJA c]JA 3 x}hsmXc] JKJAr/cR;p;p;p;rV'Ed\V4p \V PRR44P4;'gRp\V PRR44P4;'gRp\V PRR44P4;'gRp\V PRR44P4;'gRpV'gi\V PR4;'gV PR4;'gR4P4p V 'd\ V 4;'gRp\ \V PR 4;'gR44P 4;'gRp V'dVP 4R 8XdRpV'dVP 4R 8XdRpT;'gTp V'd\\V4P4P 4R 8Xd0\W4wrV'dVP 4R 8wdRpRpMdV'd]\V4P4P 4R 8Xd1\W\4wrVV'dVP 4R 8wdTp RpRp^R IH p V'd V !W4wrV'd V !WW4wrWV'd-VR 8wd&V'gV'dVRV39d TpV'gTpV'd\V4'dTMR pWW4V 3#V'dWW4V 3#V'dLV'dD\T;'gR4P4P 4\9dTMR pWWxV 3#V'dV'dVR 8wdW\VRV 3#V'd VR 8wdW\WxV 3#R V RRV 3#)aTDetermine (provider, model, base_url, api_key, api_mode) for a call. Priority: explicit args > config auxiliary.{task}.* > "auto". A bare base_url means custom, but a first-class provider + base_url keeps the provider identity so its auth/transport shaping still applies. api_mode is "chat_completions", "codex_responses", or None (auto). NrrjrrVrUrrrorrD)expand_direct_api_aliasr) rGrXrrrr~rr "hermes_cli.runtime_provider_customr0 r% r)rBrrrVrUr@rrA cfg_api_keyr6r cfg_key_envr3r0 kepts&&&&& r-rS rS s+QUTLT9T|Tk t06 ;??:r:;AACKKt  45;;=EE ;??:r:;AACKKt +//)R89??AIIT kooi8``KOOMDDFJ__|em\@QQQ )?\4ARRR .\HYYY >4/@ @@r/>@gr@)rGc0a]tRtRtoRtV3RltRtVtR#)CompressionFastLaneiuz*Explicit, non-reasoning compression route.cX<V^8dQh/S[;R&S[S[S[S[3,,;R&#)r)certified_non_reasoningr()rmrrrXr)r,rQs"r-r. CompressionFastLane.__annotate__us,"!tCH~.. r/rDNrrPs@r-r7 r7 us4r/r7 c~V^8dQhR\\\3,R\\\\3,/#r)rr*)rrXrrrm)r,s"r-r.r.|s-**T#s(^*c3n8M*r/cf^RIHp\VPR4;'gR4P 4P 4p\VPR4;'gR4P 4pV!VPR44pVRJ;'dVPR4RJpW#V3#) zDOnly explicit reasoning disablement certifies a non-reasoning route.parse_reasoning_effortrrjrrNrF)hermes_constantsr? rXrrr)rr? rr parsed_effort non_reasonings& r-_fast_lane_config_fieldsrC |s76::j)//R0668>>@H  7#))r * 0 0 2E*6::6H+IJM!-WW-2C2CI2NRW2WM M ))r/rrc V^8dQhR\R\\,R\\,R\\,R\\\\3,,R\/#)r)rrrrrr*)rXrrrr7 )r,s"r-r.r.sX,,,(0 ,NVWZm,c],9A$sCx.9Q,,r/cVeTM \R4p\V4wrgp\T;'gR4P4P 4;'gTp \T;'gR4P4;'gTp V R 9;'dV P 4R 9p \ \ \T;'gR444p V \ V 48Hp \T;'gR4P4P 4V P 48HpV 'd)V 'd!V'dV'd\RRRRR/4#\RR4#) zICertify explicit non-reasoning settings only on the matching destination.NrrjTrFrr>rjr)rGrC rXrrrrr7 )rrrrrrr@rrB rrexplicit_route actual_normprovider_matches model_matchess&&$$$ r-resolve_compression_fast_lanerJ s *5\;UVc;dF-Ef-M*L]%++,224::<LL H %%2 & , , . ; ;)E\1WWekkm<6WN)*GOLaLa_aHb*cdK"&=h&GG **+11399;u{{}LM*}"4)UHf)MNN ud ++r/cRV^8dQhR\\\3,R\/#r< rQ)r,s"r-r.r.s&``c3h`D`r/cr\V4wrpVR9;'dVP4R9;'dT#)zAWhether task config declares fast-only controls that cannot leak.>rjr)rC r)rrrrB s& r-$_compression_config_claims_fast_lanerM s8%=f%E"H] < ' _ _EKKM,M _ _R__r/cV^8dQhR\R,R\R\R,R\R,R\R,R\\\3,R\\\3,R \R,R \\\3,R \\R,\\\3,3,/ #) r)rBNrrrrrrr#r{r*)rXrrrWr)r,s"r-r.r.s **-=@4Zd 584ZOSTWY\T\~CH~47:LPPSUXPX> 3:tCH~ %& r/cVR8wgVeWx3#\V4p \WW4VR7p V PeRV 9dV PV R&Wy3#\V4'dV P RR4Wy3#)z?Apply the certified compression controls to one resolved route.rN)rrrr})rrJ r(rM r) rBrrrrrrr#r{rr.s &$$$$$$$$ r-rrs  } 6%%  D (:L}I D ( d " $ 5 5D    ..? @ @ d#  r/cFV^8dQhR\R\\,/#rArXrrO)r,s"r-r.r.sr/cV'gR#\V4PR4pVfR#\V4p\ V\ 4'gV^8:d\PRW\4R#V# \\3dRpLQi;i)u7``auxiliary..no_progress_timeout`` from config, or None when unset/invalid (the Codex and chat-stream watchdogs then keep the built-in ``_AUX_STREAM_NO_PROGRESS_TIMEOUT_SECONDS`` default). Lets an operator widen the substantive-progress window independently of the overall request timeout — see #108104.Nrrziauxiliary.%s.no_progress_timeout=%r is not a positive number of seconds; using the built-in %.0fs default) rGrrOrrr?rmrrr)rBrrQs& r-_get_task_no_progress_timeoutrS s  $T * . ./D EC {c #t   /04;b d L  "s A33B B c<V^8dQhR\R\R\/#)r)rBrr*)rXrO)r,s"r-r.r.s!C%5r/cV'gV#\V4PR4pVe>\P!\\ 4;_uu_4\ V4uuRRR4#V# +'giT#;i)z9``auxiliary..timeout`` from config, else *default*.rN)rGrrrrrrO)rBrrs&& r-_get_task_timeoutrV sY  $T * . .y 9C   Y 7 7:8 7 N8 7 Ns  A(( A9 cRV^8dQhR\R\\,R\/#)r)rBrr*rQ )r,s"r-r.r.s*fffxf5fr/cVVeV#\V4pVR8Xd\V\4#T#)zExplicit ``timeout`` wins, else config; compression gets a floor so a reasoning model summarising a large context isn't cut off.r)rV r"_COMPRESSION_TIMEOUT_FLOOR_SECONDS)rBr effectives&& r-_effective_aux_timeoutr[ s4!$'IAEAV3y< =e\eer/c V^8dQhR\\,R\R\\,R\\,R\\,/#)r)r{rrrVr*r})r,s"r-r.r.sE///*-/6>sm/OWX[}/ d^/r/c $V'gV#^RIHp^RIHpHpT!T;'gRT;'gR\ V4V!V!44R7pT'gT#/TCT;'g/C# \ d\PRRR7Tu#i;i)aLayer the destination custom provider's ``extra_body`` UNDER the task/caller body. The main agent merges a ``custom_providers`` / ``providers:`` entry's ``extra_body`` into every request to that endpoint (``agent_init._merge_custom_provider_extra_body``); an aux request routed to the same entry must carry it too, or a proxy that 400s without e.g. a ``user`` field breaks smart approval, titles and compression (#103738). Resolved per destination with the agent's own matcher, so a fallback to another provider never inherits it; ``auxiliary..extra_body`` and caller keys win on conflict, as request_overrides win over the entry on the main path.)%_custom_provider_extra_body_for_agent)get_compatible_custom_providersrrj)rrrVcustom_providersz8custom provider extra_body lookup failed for aux requestTr) agent.agent_initr^ rr_ rrXrrr)r{rrrVr^ r_ r inheriteds&&&& r- _with_custom_endpoint_extra_bodyrc s  J[9^^5;;BX<=Q=ST   .i .J,," ..  OZ^ _sA( A(A(($BBcRV^8dQhR\R\\\3,/#rA)rXrr)r,s"r-r.r.s"stCH~r/cl\V4pVPR4p\V\4'd \V4M/pRV9dV#VPR4pVeVR8XdV#VR9d\P RV4V#^RIHpV!V4pVeWcR&V#\P RW4V#) zShallow copy of ``auxiliary..extra_body`` with ``reasoning_effort`` folded into ``reasoning`` unless one is configured (more specific wins). MoA tasks are excluded: their reasoning depth is per-slot in the preset.r{r}rrjuauxiliary.%s.reasoning_effort is not supported — MoA reasoning depth is per-slot: set reasoning_effort on the preset's reference_models entries / aggregator instead (moa.presets....). Ignoring.r> uxauxiliary.%s.reasoning_effort %r is not a valid level (none, minimal, low, medium, high, xhigh, max, ultra) — ignoring) moa_referencemoa_aggregator)rGrr?rrrr@ r? )rBrrr_rr? rs& r-_get_task_extra_bodyrh s-T2K //, 'C$S$//T#YRFf __/ 0F ~2  22 o   7 #F +F ${ M  G   Mr/c\V^8dQhR\\,R\\,/#rArJ)r,s"r-r.r.%s" ( (HSM (hsm (r/cV'dVR8XdR#\\V4PR44pT^8dT#R# \\3dR#i;i)z``auxiliary..max_concurrency`` as a positive int, or None. Vision uses this key for its encode/resize CPU pool; its LLM calls stay concurrent.rNmax_concurrency)rWrGrrr)rBrQs& r-_get_task_max_concurrencyrl %s^ 48#.t4889JKLAI5'4' z "s#AAAc xV^8dQhR\R\R\R\\.\3,R\/#)r)rzrlimitfactoryr*)rrrWr)r,s"r-r.r.1s<TC(C5RU:BV[^r/c\;_uu_4VPV4pVeV^,V8wdW#!V43;W&pV^,uuRRR4# +'giR#;i)zNReturn the cached semaphore for ``key``, rebuilding it when the limit changed.N) _aux_sem_lockr)rzrrn ro rs&&&& r-_cached_semaphorerr 1sL  # =E!H-"'!8 8EJQx s 9A A$ cpV^8dQhR\\,R\\P,/#rA)rrXrBoundedSemaphore)r,s"r-r.r.:s-qqhsmqA[A[8\qr/c~\V4pVfR#^RIHp\\V!4V3V\ P 4#)zCGet a per-task sync semaphore, rebuilding it after a config change.Nr)rl r@ rrr _aux_sync_semaphoresrrt )rBrn rs& r-_acquire_sync_aux_semaphorerx :s8 %d +E }0 1O4Et3LeU^UoUo ppr/c:V^8dQhR\\,/#)r)rBr)r,s"r-r.r.Cs s sx} sr/c\V4pVfR#^RIpVP4p^RIHp\ \T!4T\T43YP4# \dR#i;i)zCGet a per-task, per-event-loop async semaphore after config lookup.Nrv ) rl rr rcr@ rrr _aux_async_semaphoresr2 Semaphore)rBrn rr rs& r-_acquire_async_aux_semaphorer} Csi %d +E }'')1 2_5FbQUh4WY^`q`q rr sA A('A(cV^8dQhRR/#rrD)r,s"r-r.r.Qs&&t&r/c\;_uu_4\P4\P4RRR4R# +'giR#;i)z%Drop cached semaphores (test helper).N)rq rw rer{ rDr/r-_reset_aux_semaphoresr Qs+ ""$##% s )A A c<V^8dQhR\R\R\/#r)rrVr*r.)r,s"r-r.r.]s&__C_3_4_r/c^V\9;'gRT;'gRP49#)zMTrue for known Anthropic-compatible providers or any ``/anthropic`` URL path.rrj)_ANTHROPIC_COMPAT_PROVIDERSrrhs&&r-r@r@]s+ 2 2 ^ ^lx~~SUF\F\F^6^^r/ image_url video_urlc0V^8dQhR\R\/#)r)rmr*)r)r,s"r-r.r.hs$4r/c.pVEFdpVPR4p\V\4'gVPV4K>.pRpVFpVPR4pV\9dVPV4K2VPV4;'g/PRR4p\V,wrVP R4'd\VP R4wrp RV 9d8R V 9d1V PR^4^,PR ^4^,p RR R V R V /pMRRRV/pVPRV R V/4RpK TPV'd /VCRV/CMT4EKg V#)zConvert OpenAI ``image_url``/``video_url`` blocks to Anthropic ``image``/``video``; only list-content messages with such blocks change.rnFr+rrjzdata:,r;r media_typerrT)rr?rr_ANTHROPIC_MEDIA_BLOCKSr partitionr)rm convertedrrn new_contentrr, block_typer anth_typer headerrb64datars& r-rArAhsfI'')$'4((   S !  E6*J!88""5)99Z(..B33E2>C$;J$G !I~~g&&%(]]3%7"7&=SF]!'c1!5a!8!>!>sA!Fq!IJ (L*fgV %4    8VD EG G8C8K8M/0 r/c0V^8dQhR\R\/#)r)rQr*r)r,s"r-r.r.scdr/c\V\4'gR#\;QJd*RVP44F 'gK R# R#!RVP444#)zOReturn whether a profile payload contains a reasoning wire control (recursive).Fc3"TFHwr\V4P4P4\9;'g \ V4xKJ R#5ir8)rXrrr"_contains_profile_reasoning_fields)r#rnesteds& r-r%5_contains_profile_reasoning_fields..sE(KC C $;;ii?abh?ii(s ;AAT)r?rr3rrSs&r-r r sY eT " " 3 ;;=3333 ;;= r/c<V^8dQhR\R\R\/#)r) provider_normrr*r.)r,s"r-r.r.s!88#8c8d8r/c>V\9dR#^RIHpV!V4R8H#)zUTrue when a Nous Portal route serves ``model`` over /v1/messages (dual-wire catalog).Fr r,)_NOUS_PROVIDER_NAMESrr )r rr s&& r-_nous_on_messages_wirer s"002  #7 77r/c<V^8dQhR\R\R\/#)r)r effective_baser*r.)r,s"r-r.r.s!  3   r/crV\9dR#V'gR#^RIHpV!V4# \dR#i;i)zEGemini native by provider name, else (best-effort) by base URL shape.TF)r)_GEMINI_NATIVE_PROVIDER_NAMESrrr)r r rs&& r-_is_gemini_native_router s955 I(88 s ' 66c vV^8dQhR\R\R\R\R\\,R\/#)r)rr rr rBr*rZ)r,s"r-r.r.s?3s3X[cklocpuyr/cB\W4;'g\W4;'g{V\9;'gj\VR4;'gV\ V4R8H;'g@\ W4;'g-VR8H;'g \VR4;'g \ V4#)uWhether an explicit max_tokens is forwarded on this route. No default cap elsewhere (omitted = provider default; avoids max_completion_tokens / ZAI-vision quirks). Forward only where mandatory or honored: Anthropic Messages wire (400 without it); NVIDIA NIM (empty choices[] when omitted); MoA reference slots; Gemini native (fixed 65,535 ceiling otherwise); OpenRouter (budgets the FULL window when omitted → 402 on low credit); managed local llama-server (uncapped decode with no EOS burns the GPU to the context window). rwrf rcr)r@r _NVIDIA_PROVIDER_NAMESrrXr r)rr rr rBs&&&&&r-_forwards_max_tokensr s &h? 6 6 !- 7 6 6 2 2 6 6 !1K L 6 6 t9 '  6 6 #= A  6 6 L (  6 6 ! A 6 6 &n 5 r/cHV^8dQhR\R\R\R\/#)r)rirrr*ro )r,s"r-r.r.s(  d c # $ r/c(\4p.pVFpVPR4;'g/PRR4pV'd Wc9d\PRWaV4KUV'dVP V4VP V4K V#)zLDrop duplicate tool names (Vertex/Azure/Bedrock 400 on them) with a warning.rsr`rjzK_build_call_kwargs: duplicate tool name '%s' removed (provider=%s model=%s))rbrrrrr)rirrrdedupedtoolr`s&&& r-_dedupe_tool_namesr s|DG$**//; DL NNhjnz A   HHTNt Nr/c0a]tRtRtoRtV3RltRtVtR#)_ProfileProjectioniFc<V^8dQh/S[S[S[3,;R&S[S[S[3,;R&S[S[S[3,;R&S[;R&S[;R&#)r)rreasoning_extra top_levelhandles_reasoning messages_wirerQ)r,rQs"r-r._ProfileProjection.__annotate__sZ sCx.#s(^#CH~   r/rDN)rHrIrJrKr rrNrOrPs@r-r r s  M r/r c0V^8dQhR\R\/#)r)r r*r.)r,s"r-r.r.s 8 8c 8d 8r/cJ\V4pVR8XdR#^RIHpV!V4RJ#)aTrue when a profile-less provider name is really a configured OpenAI-compatible custom endpoint. Keyed ``providers:`` / ``custom_providers`` entries (by bare key, or ``main``/``auto`` resolving to one). An unconfigured name with only an explicit base_url keeps the generic nested fallback: the operator declared nothing about that endpoint's wire, and the fireworks control contract pins it. rTrN)rrr)r r`rs& r-_routes_to_custom_endpointr s, #= 1D xF %d +4 77r/cV^8dQhR\R\R\R\R\\,R\\,R\/#)r)rr rr r(data_user*)rXrr frozensetr )r,s"r-r.r.sa%b%b%b"%%b.1%bCF%bZbcgZh%bt}BuC%b%br/cb/p/p/pRp Rp ^RIHp ^RIHp V !V4p V f\ V4'd V !R4p V eV P R8Hp V P W#WER7;'g/pV PWDRJW#R7wrxT;'g/pT;'g/p\V 4PV PJ;'g2\V4;'g\V4;'g \V4p \YgYT 4# \d!p\PR Y4Rp?L3Rp?ii;i) zFProvider profile's extra_body / kwargs projection; partial on failure.Fr )ProviderProfileNrr,)rrVr(r )r(supports_reasoningrrVzA_build_call_kwargs: provider profile projection failed for %s: %s)rr providers.baser r robuild_extra_bodybuild_api_kwargs_extrasr+r rrrr )rr rr r(r rr r r r r r r3rcs&&&&&& r-_project_provider_profiler sfD&(O "IMi22&}5 ?9-HH +84G  #,,0DDM++%cs+HNNLND)0)H)H!1^bFb*I* &O.33O!RIW 55_=d=ddAA5d;AA5oFAA6i@  dYS` aa i XZbhhis6AD*.D*DDD* D D.D))D.c V^8dQhR\\,R\R\\,R\R\\\3,/#)r)r{ projectionr(r r*)rrr rXr)r,s"r-r.r.sF///,>/RZ[_R`/qt/ #s(^/r/c\T;'g/4pVP4UUu/uFgwrV\V4P4P 4\ 9gK7\V4P4P 4R8wgKeWVbKi ppp\ V\4;'dVPR4RJpV'dVPRR4VPVP4VPVP4VPV4VP'g^RI Hp VPV !V44\ VPR4\4'd^RI Hp V !VR,4VR&V\ 9d6RV9d\#4VR&RV9d^R IHp V !4p V 'dWR&V#uuppi \(dRp L#i;i) zTCaller extra_body + profile body/reasoning + generic reasoning fallback + Nous tags.r}rFN)generic_nested_reasoningclamp_reasoning_configrr)get_conversation_context)rrrXrrrr?rrrrr r rr r r ragent.portal_tagsr r) r{r r(r merged_extrarrQcaller_reasoning_fieldscaller_disabledr r r sticky_keys &&&& r-_merge_aux_extra_bodyr s ((b)L%1%7%7%9%9zs s8>>  ! ! #'> > CFs8>>CSCYCYC[_jCj  %9!!148ee=M=Q=QR[=\`e=eO d+ ( 223/0  ' ' 'C45EFG,"";/66A$:< ;T$U [!,,  %#4#6L | + "F57 -7\* UL "!  "s#4G")GG8 G G)(G)cdV^8dQhR\R\R\R\\,R\\,R\\,R\R\\ ,R \\ ,R \\,R \\,R \\,R \ / #)r)rrrmr%r#rirr{r(rVrBrr*)rXrrrOrWr)r,s"r-r.r.HsGqGqGqGq)-GqE*d### 4 nd + + ^0Kj)J NN; ''#1 -.CDTVces}A/BC*8]E[knBCKnLMJ MM*&&'(ZAQS`aLL(Y:<Xfost +|J'7>>>>r [ (J,D,D,DH^_lnsHtHt28<<@]^kmu@v@v*./?*@F& 'G )&HFYZfFgFoFoko ppr/c V^8dQhR\R\\,R\\,R\\,R\/#)r)rrBrrVr*r)r,s"r-r.r.sB888!#89A#8YabeYf88r/c zVf\RT;'gR R24h\W4p^RIHpV!WW#R7VPpV'd\ V^,R4'g \ R4h^RIHp V !V4'd'\RT;'gR R24p \%V 4V h\*P-4p V e=\/VR4p \1V \4'dV P34'dWR&\54V# \ \\3dp\T4pTf|\RT;'gR R \T4P R \T4R ,: R 24p^R I Hp \YP T P#T44\%T4YhTpRp?ELBRp?ii;i)uIValidate the .choices[0].message shape (fail fast, not a downstream AttributeError). Also the single aux-usage accounting chokepoint: every successful non-streaming response passes here exactly once; *provider*/*base_url* are optional hints. Async callers await this off-loop because accounting may commit through synchronous worker RPC. See #7264. Recording is best-effort and never affects validation. *provider*/*base_url* are optional accounting hints — fallback-path calls omit them and the row keeps the model (read from the response itself) with an empty route. See #23270. Nr:r_z: LLM returned None response)record_aux_usagerhrzmissing choices[0].messagez&: LLM returned invalid response (type=z): :NxNug. Expected object with .choices[0].message — check provider adapter or custom endpoint compatibility.auxiliary_call_outcome)is_router_timeout_shimz:: provider returned a timeout shim instead of a completionrr_)rc_unwrap_data_envelopeagent.aux_accountingr rrrr IndexError_recover_aux_response_messager+rHrXrr setattrPROVIDER_ERROR_ATTRembedded_provider_errorr!agent.transports.chat_completionsr rarrr?r_complete_relay_auxiliary_call)rrBrrVr rrc recoveredinvalidr r shimryrs&&&& r-rJrJs((D E  %X4H5XhJ""ggaj)<< !=> >=$Ih''j(88rst#D) %))+Gx) eS ! !ekkmm(-$ %"$ O= Iz 21(;  "T^^V,,RSWX`SaSjSjRkknx=&)*<=G 5 GGG*BB8L N ' 0 "s8D F:#F5A.F55F:rfsuccess error_classcJV^8dQhR\R\\,RR/#)r)rfr r*NrL)r,s"r-r.r.s'  s XVY] fj r/c \P4pVfR#^RIHpTP \ VPR4;'gR4T\ VPR4;'gR4\ VPR4;'gR4VPR 4T;'gVPR 4;'gR R 7R#) zClose one auxiliary logical call after acceptance or terminal failure. A success reports the last attempt error it recovered from (``none`` when the first attempt held).Nrr]rjrr\rrr_r r)rfrrresponse_model_namer )rarrrcomplete_logical_callrX)rfr ryrs$$ r-r r s&))+G ## GKK % + +,gw{{7+88y9'++j1@@[A#KK(89GG7;;}#=GG $r/c(V^8dQhR\RR/#r)rcr*Nra)r,s"r-r.r.see]eter/c ,\P4pVe|\V\4'dd^RIHpTP T\VPR4;'gR4\VPR4;'gR4R7VR&R#R#R#)zDRemember one failed attempt's classified reason on the logical call.Nr rrjrr@r )rarr?rrr r rX)rcryr s& r-rrs~%))+Gz#y990!7!C!C #gkk*5;;}, "success": true}. Some OpenAI-compatible gateways (e.g. api.cline.bot) wrap non-streaming JSON bodies in a data/success envelope. The SDK leniently parses this into a ChatCompletion with choices=None and keeps the envelope keys as extra fields, so the real completion is reachable at ``response.data``. Error envelopes ({"success": false, "data": {"error": ...}}) raise the provider's actual error instead of a generic invalid-response error. rrr FrrNr:r_z$: provider returned error envelope: rrYrrr2rjrrchat.completionrr2rrrrrD) rr?rrrcr+model_validaterrrrr)rrBrrrrchs&& r-r r sh "" (F #D dD ! ! h "e+hhw''4$.sD$9$9cggi t((Lzzcl    88I   H~,,T22 Iz 2   G9oo#-b$#7#7bffYT c4 NN?'.#. ff_5??    88D" hhw#xx"34hhw  s C&&C?>C?cFV^8dQhR\R\\,/#r)rr*)rr)r,s"r-r.r.%s  C HSM r/c 6\V4pV'gR#\\VR7\VRR4;'gRR7pV.VnV# \dA\\TRR4\TRR4\TR R 4T.\TR R4R 7u#i;i) zSynthesize chat-completions shape from Responses-style text (``output_text``, ``output`` items) that some compatible endpoints return outside ``choices``.N)rnrrYr r2rjrrr rr )_extract_aux_response_textrrqrr)rr-rs& r-r r %s &h /D  _T%BRYZbdsuyRzSESEEFF "8  xr*'(GR2P8X/@AF8(GT2   s A ABBc0V^8dQhR\R\/#r r)r,s"r-r.r.7s$$$$r/c~\VR4p\V\4'd'VP4'dVP4#\VR4p\V\4'gR#.pVFp\VR4pV'd VR8wdK \VR4;'g.Fqp\VR4R 9gK\VR4p\V\4'gK:VP4'gKRVP VP44Ks K RP V4P4#) zIText from Responses-style ``output_text`` or ``output[].content[].text``. output_textrrjr+rrnr- >Nr-r )rr?rXrrrr)rr rpartsitem item_typerr-s& r-r r 7s=1K+s## (9(9(;(;  "" Hh 'F fd # #E4( i/ D),222DdF#'DDdF+dC((TZZ\\LL. 3  99U  ! ! ##r/g@g@cFV^8dQhR\\,R\/#)r)r7r*rN)r,s"r-r.r.Ss"\\%\U\r/cVe \V4MRp\\\ V,4# \\3dRpL0i;i)uAbsolute wall-clock bound for a streamed aux call; generous by design (the idle timeout is the real guard — this only stops a one-token-per-idle-window trickle).r)rOrrr!_AUX_STREAM_CEILING_FLOOR_SECONDS_AUX_STREAM_CEILING_MULTIPLIER)r7rs& r-rrSsL.?.K%)*QT 02PSZ2Z [[ z "s.AAc0V^8dQhR\R\/#r)rr*r)r,s"r-r.r.]shhshthr/c8\V\\\34#)zAdapters that stream inside .create() tick the hook themselves (Codex, Anthropic) or cannot stream (Bedrock); none accept ``stream=True`` from us.)r?rrAr_rs&r-_client_streams_internallyr ]s f35MOef ggr/cRV^8dQhR\R\\,R\/#r rZ)r,s"r-r.r.cs%x}r/ca\T;'gR4P4oS'gR#\SR4'g\S4'dR#^RIHpV!4;'g/P R/4P R4;'g.p\V\\34'd;\;QJdV3RlV4F 'gK R# R#!V3RlV44#R# \dR#i;i) uProviders that only accept streaming (non-stream = 400): Tencent Copilot, any ``auxiliary.stream_only_base_urls`` substring, and the managed local llama-server (streamed for cancellation — it only notices a dead client on socket write).rjFzcopilot.tencent.comTrBrstream_only_base_urlsc3<"TFVp\V\4;'d:VP4;'d"VP4P4S9xKX R#5ir8)r?rXrr)r#markerrs& r-r%,_provider_requires_stream..psM'%F63']]FLLN]]v||~?S?S?UY]?]]%sA!A!*A!) rXrrrrrXrr?rrr3r)rrVrXmarkersrs&& @r-rrcs x~~2  $ $ &D T#899=WX\=]=] 1=&&B++K<@@AXY__]_ ge} - -3'%'33 '3 '3'%'' ' .     s6C.)(C.)C.<C.C.C.C.. C=<C=z can only afford\s+([0-9][0-9,]*)icFV^8dQhR\R\\,/#ro)rrrW)r,s"r-r.r.s"HH9H#Hr/c6\V4'gR#\P\V44pV'gR#\ VP ^4P RR44pT\, pT\8dT#R# \\3dR#i;i)zAffordable output budget (minus margin) from an OpenRouter credit-limited 402 ("...but can only afford 7117": credit exists, the cap was too large); ``None`` when no count is present or the budget is too small to be useful.Nr rj) rz_AFFORDABLE_TOKENS_REsearchrXrWrreplacerr_AFFORDABLE_RETRY_MARGIN_TOKENS_AFFORDABLE_RETRY_FLOOR_TOKENS)rcr affordablecappeds& r-!_affordable_max_tokens_from_errorr% s S ! ! ! ( (S 2E Q//R89 9 9F==6G4G z "s*BBBrc V^8dQhR\R\\\3,R\\,R\R\/#r)rr;rBrr*rrrXrrm)r,s"r-r.r.sGaa ac3ha/7}aVZaar/c j\WW#R7# \Edp\T4pTfhTPR4;'gTPR4p\ T\ \ 34'd^Tu;8d T8:dh\T4pTPRR4TPRR4TP\T\TPR4;'gR4;'gRR74\PRT;'gR YT4\YY#R7uRp?#Rp?ii;i) zCredit-aware :func:`_create_with_progress_once`: a 402 naming an affordable budget retries ONCE with that cap (only ever lowering); anything else re-raises.rNr#r$rrjrzwAuxiliary %s: credit-limited 402 (affordable=%d tokens); retrying once with a clamped output cap instead of failing: %sr_)_create_with_progress_oncerr% rr?rWrOrrrr rXrr+)rr;rBrrcr# existing_caprs&&&$ r-rrs a)&$ZZ a6s;   zz,/VV6::>U3V lS%L 1 1a,6T*6T 7UF| t,0$7 &zVZZ=P=V=VTV9W9_9_[_ ` b UNNFJ 5*&``as-  D2'D-B*D-.$D-D-'D2-D2c V^8dQhR\\\3,R\R\\\\3,\\3,/#)r)r;rr*)rrXrrrO)r,s"r-r.r.sB > >c3h > >dSVX[S[n^achNhHi >r/c "\V4pRVR&RR/VR&\\\VRR4;'gR44'd \ V4pT\VP R4;'gR4\ VP R443#) z(stream kwargs, model name, total ceiling) for a streamed re-aggregation. Requests to the managed llama-server also ask for prompt-reading progress, which keeps the watchdogs fed through a long prefill.Tr include_usagestream_optionsrVrjrr)rrrXrqrrr)r;rrs&& r-_stream_request_planr0 sLM"M('6&=M"#!#gfj"&E&K&K"LMM,]; 3vzz'288b9 %fjj&; < >>r/c V^8dQhR\R\\\3,R\\,R\R\/#r' r( )r,s"r-r.r.sG5q5q 5qc3h5q/7}5qVZ5q5qr/c b\W4p\4\4'g V'd\V4'dDVPP P !R/VBp\V4'g \4V#\W4wrVpVPP P !R/VBp\!TR4'd \4T#^RIHp \'YYz!YT4R7# \dp T'gE\T 4'g4\T 4'g#\T 4'g\T 4'dh\PRT;'gRT 4\4TPP P !R/TBp\4TuRp ? #Rp ? ii;i)ucreate() that streams (and re-aggregates, ticking the hook per substantive chunk) when a progress hook is active or the provider is stream-only; plain ``create(**kwargs)`` otherwise or when the adapter streams internally. Streaming rejections fall back to a plain call — except under ``force_stream``. Behavior is byte-for-byte identical to a plain ``create(**kwargs)`` when neither trigger applies (every existing caller/task) or when the client's wire adapter streams internally. With a hook + a chunk-capable client, the request is sent with ``stream=True`` and aggregated, ticking the hook only for substantive chunks. The configured ``timeout`` acts per stream read (idle) rather than as a total budget, and outer liveness watchdogs see tokens moving. ``force_stream=True`` (stream-only providers such as Tencent Copilot — credit @kudi88, PR #60686) takes the same streamed path even without a hook. Providers that reject the streamed request fall back to the plain non-streaming call — except under ``force_stream``, where a stream-only provider rejects the plain call by definition, so the original error is surfaced to the normal recovery chains instead. zBAuxiliary %s: streamed request failed (%s); retrying non-streamingr_Nr)chat_stream_windows)r total_ceiling no_progressrD)r$rrr rrrrr0 rrrrzrrrragent.auxiliary_stream_watchdogr3 _aggregate_chat_stream) rr;rBrrrrr4 chunksrcr3 s &&&$ r-r* r* s^$/v >F ! " "<v*N'M-((//@-@"vy!!%' C !=FYZ`jnFo qq)   9#>>.QTBUBU$S))-A#-F-F   Y^^VS *;;**11;F;%' s&&C// F.:A%F) AF)#F.)F.r4 r5 c V^8dQhR\R\R\\,R\\\\\,3,,R\/#)r)r8 rr4 r5 r*)rrXrrOr)r,s"r-r.r.sM     4 izIShared per-chunk accumulation so sync and async aggregation cannot drift.Nc |<V^8dQhRS[RS[S[,RS[S[.S[R,3,,R,/#)r)rr4 r@N)rXrrOr)r,rQs"r-r.#_ChatStreamAccumulator.__annotate__s?&&c&x& %UT\1A(B BT I&r/c \P!4Vn\VP4VnW nW0n.Vn.Vn.Vn /Vn R;Vn Vn RVn T;'gRVnR#)Nrj)r=r>_startedr_prompt_reading_total_ceiling_host_deadline content_partsreasoning_partsreasoning_detailstool_calls_accrrresp_id resp_model)r9rr4 r@s&&&&r-r\_ChatStreamAccumulator.__init__sr( 1$--@+ ,(**,,.9;*..TZ ++2r/c<V^8dQhRR/#rrD)r,rQs"r-r.rB s 9 9$ 9r/c \P!4pVPeWWP, VPP , VP8d\ RVPR R24h\VP4'dVP4M VPpVe=W8d5\ R\P!4VP, R R24hR#R#)z?Raise TimeoutError past the total ceiling or the host deadline.Nz(Auxiliary streamed call timed out after r<z3s total ceiling (stream still open but over budget)zIAuxiliary streamed call timed out at the host compression deadline after zUs (the caller already stopped waiting; streaming on would only pin its session lease)) r=r>rF rD rE secondsr?rrG )r9rar@s& r-_check_deadlines'_ChatStreamAccumulator._check_deadlinessnn    *mm0CdFZFZFbFb0bgkgzgz/z!I$J]J]^aIbcS ST T19$:M:M1N1N++-TXTgTg  $)= 1151ADMM1QRU0VW8 89 9*> $r/c&<V^8dQhRS[RS[/#r)r r*r)r,rQs"r-r.rB 'sSTr/c a\VRR4pVf5\VRR4p\V\4'dVPR4p\V\4'gR#RpVFoVP P S4\S\4'gK6\;QJd#V3Rl\4F 'gK RM RM!V3Rl\44'gKRpK V#)zCollect ``reasoning_details`` (OpenRouter-style thinking); True only when a detail carries text, so structural/signed envelopes can't keep a stall alive.rJ N model_extraFc3<"TF5p\SPV4\4;'d SV,xK7 R#5ir8)r?rrX)r#r$details& r-r%A_ChatStreamAccumulator._feed_reasoning_details..4s40eFc 6::a=#.<<6!9E  $!%=K+t,,$/OO4G$H!+T22 'F  " " ) )& 1&$''CC0eFc0eCCC0eFc0e-e-e $ ( r/c&<V^8dQhRS[RS[/#rU r)r,rQs"r-r.rB 9scdr/c  Rp\VRR4;'g.Fp\VR^4;'g^pVPPVRRRRR./4p\VRR4'dVPVR&R p\VR R4pVfKs\VRR4'dVPVR&R p\VRR4'gKVR,P VP 4R pK V#) zHMerge tool-call fragments by index; True when any fragment carried data.FrrNrr2rjr` argumentsTrs)rqrK rr2r`rra )r9r r\ ridxr? fns&& r-_feed_tool_calls'_ChatStreamAccumulator._feed_tool_calls9s 5,5;;;B"gq)..QC%%00tR[Z\6]^Cr4&&EED $ Z.B~2vt,,"$''CK$(M2{D11 $++BLL9$(M<r/c&<V^8dQhRS[RS[/#)r)chunkr*r)r,rQs"r-r.rB Ls//#/$/r/c\4\V4pVRJ;'dVPPV4pVP 4\ VRR4;'g VP Vn\ VRR4;'g VPVn\ VRR4pV'dW@nVeV'd \4R#\ VRR4;'g.pV'gR#V^,p\ VRR4;'g VPVn \ VRR4pVfR#Rp^RI H p V !\ VR R4R R 7p V 'dVPPV 4R p\ VR R4;'g\ VRR4p V f`\\ VRR4\ 4'd?VP"P%R 4;'gVP"P%R4p V !V R R 7p V 'dVP&PV 4R pWP)V4,pWP+V4,pV'd \4V#)Nr2rrFrrr )flatten_message_textrnrj)sepTr}reasoning_contentrW )r rrE tickrR rqrL rM rrragent.message_contentri rH rr?rrW rrI r] rd ) r9rg r read_more chunk_usagerrr r\ ri piecereasoning_pieces && r-feed_ChatStreamAccumulator.feedLs $%"5)D(PPT-A-A-F-Fx-P  udD1AAT\\ !%$7JJ4??eWd3 $J  $&%D177R$V_dCYYtGYGY. = >$WUIt%D"M     % %e , M!%d;hhwuNacg?h  "z'%PT2UW['\'\#//33K@nnEDUDUDYDYZmDnO.BG   ' ' 8 M55e<< ..u55  "r/c <V^8dQhRS[/#r(r9)r,rQs"r-r.rB }sCCCr/cxRpVP'dr\VPP44UUu.uFBwr#\VR,R\VR,RP VR,4R7R7NKD ppp\RRP VP 4TRP VP 4;'gRVP;'gRR 7p\^Y@P;'gR R 7p\VPVPR V.VPR 7#uuppi)Nr2rsr`rjra )r`ra )r2r+rsr)rornrrr}rJ rYrr r ) rK r"rrrrH rI rJ rrL rM r)r9rr_idxr? rrs& r-rO_ChatStreamAccumulator.finish}s    "((;(;(A(A(C!DF"EID 3t9:VK8H0IIKL!D F"bggd.@.@&Ajggd223;;t"44<<  !q'I[I[IeIe_ef$,,dooN_(.xtzzC CFsAD6) rG rE rD rF rH rrJ rI rL rM rK r)rjNN) rHrIrJrKrLr\rR r] rd rr rOrNrOrPs@r-r> r> sGS&&( 9 9$&//bCCr/r> c^V^8dQhR\R\R\\,R\/#)r)r8 rr4 r*)rrXrrO)r,s"r-r.r.s0 4 rDrr r6 r; rrrrO)r8 rr4 r? rg r; pendings&$$ r-_aggregate_chat_stream_asyncr| s !@\ ^C!  % HHUO 6 H%f4@  $$Y// 0 ::<0/ ::<  ::< H%f4@  $$Y// 0/// s}D(C646C6C6D(.B4A75B:D( B1 (D(7D%<D D D  D% D!  D%%D(cV^8dQhR\R\\\3,R\\,R\/#)r)rr;rBr*)rrrXr)r,s"r-r.r.s<``s`DcN`(SV-`cf`r/c"\W4wr4pVPPP!R/VBGRjxL p\ VR4'dV#\ WdVR7GRjxL #L-L5i)zWAsync create() for stream-only providers: ``stream=True`` + aggregate the async chunks.Nrrr4 rD)r0 rrrrr| )rr;rBrrr4 r8 s&&& r-_acreate_with_streamr sc*>v*N'M-;;**11BMB BFvy!! -fQ^_ __C `s!8A,A((A,#A*$A,*A,c0V^8dQhR\R\/#r r)r,s"r-r.r.swwSwTwr/c8\V\\\34#)z[Async twin of :func:`_client_streams_internally` (the async adapters are separate classes).)r?rrKrjr s&r- _async_client_streams_internallyr s f8:WYtu vvr/c V^8dQhR\R\\\3,R\\,R\R\/#r' r( )r,s"r-r.r.sG ` `  `c3h `/7} `VZ ` `r/c"\W4p\4\4'g V'd\V4'dLVPP P !R/VBGRjxL p\V4'g \4V#\W4wrVpVPP P !R/VBGRjxL p\!TR4'd \4T#\#YTR7GRjxL #LL9 \dp T'gE\T 4'g4\T 4'g#\T 4'g\T 4'dh\PRT;'gRT 4\4TPP P !R/TBGRjxL p\4TuRp ? #Rp ? ii;iL5i)zAsync :func:`_create_with_progress`: stream + re-aggregate (ticking the hook per substantive chunk) when a progress hook is active or the provider is stream-only; plain create otherwise.NzHAuxiliary %s: streamed async request failed (%s); retrying non-streamingr_rr rD)r$rrr rrrrr0 rrrrzrrrrr| ) rr;rBrrrrr4 r8 rcs &&&$ r-rrsg /v >F " "<<\]cv*N'M-{{..55F FFvy!!%' -fQ^_ __/B G   9#>>.QTBUBU$S))-A#-F-F  _^^VS *0077A&AAA%'  `sw-G :G *C<+/G )DC>D .G 7G 8G >D G A%G1;G,F/-G=G>G GG c,a]tRtRtoV3RltRtVtR#)_ResolvedAuxRouteicZ<V^8dQh/S[;R&S[S[,;R&S[;R&S[;R&#)r)rr9rrBr)r,rQs"r-r._ResolvedAuxRoute.__annotate__s8 K# r/rDNrrPs@r-r r rr/r cV^8dQhR\\,R\\,R\\,R\\,R\\,R\R\\,R\\,R \\,R \\,R \\\\3,,R \R \ / #)r)rBrrrVrUrr3r4r5r6rrr*)rrXrrrmr )r,s"r-r.r.s9Y9Y 3-9Y&.sm9Y\PR T;'gR V4\RWVR 7wr\ V R4p V f\RV RV R24h\WW\4#)zResolve the client for one aux call: vision chain, or cached text client with the explicit-provider fallback_chain / auto-chain rescue; RuntimeError when nothing is configured.rr)rrrVrUrrNzDVision provider %s unavailable, falling back to auto vision backends)rrrr)rrVrUrorrBrjrrzBAuxiliary %s: provider %s unavailable, trying auto-detection chainr_)rrrBz$No LLM provider configured for task=z provider=z. Run: hermes setup>rrrc)r<rrr=r>rrrgrrrrr+r )rBrrrVrUrr3r4r5r6rrrBrr9 _explicitrrr nous_details&$$$$$$$$$$$ r-_resolve_call_clientr s+ x2P*;v*E&8 ))E4E4Q4Q$//J3 /K >/69BS NNa, .6T~)7+ 3     2 G G6G 0 *$|+00b779??AIY.NN0_1%- 8X$FOSYFY"@"B_cK4#VV'KI'VXX&/ *:!8>>rdh>N+Q'F$,$A$A0A!%6"~&7 ` NNF,=?&8zSW'Y#%CFF%S" ~(+OPTvV55F4GGZ*\] ] V2C XXr/c,a]tRtRtoV3RltRtVtR#)_PreparedAuxRequestic&<V^8dQh/S[;R&S[S[,;R&S[S[S[3,;R&S[;R&S[;R&S[S[,;R&S[S[,;R&S[S[,;R&S[S[,;R &S[;R &S[S[S[3,;R &S[;R &#) r)rr9r;rrequest_providerr3r4r5r6r7r8 base_info)rrrXrrO)r,rQs"r-r. _PreparedAuxRequest.__annotate__s K# cN    SM!  }$sm# }$sCx.(Nr/rDNrrPs@r-r r rr/r c$V^8dQhR\\,R\\,R\\,R\\,R\\,R\\\3,R\R\\ ,R \\ ,R \\,R \\ ,R \\,R \\,R\\\\3,,R\\,R\\\\3,,R\R\/#)r)rBrrrVrUrrmr%r#rirr{r(rZror|rr*) rrXrrrrOrWrmr )r,s"r-r.r.'s A)A) 3-A)&.smA)N+,S] B>FK*,> /t= f35NO P P &d+VZ*>>-> AEAV7=\^"A "2'M_0Z+ #   />OPz#@AQ#RT_` B7==2>  4EFLL"M  KK7/996;;S;S)/8\QZ=Z4 {+`b d  +xU_.;O)I4R4RARY]/ 1F "&}"5gfj"5;;@Qi ))r/c0a]tRtRtoRtV3RltRtVtR#) _LadderStepikzA provider request the ladder asks its driver to perform. kind: "call" (client, kwargs) | "retry_same_provider" (provider, model) | "fallback" (fb_client, fb_model, fb_label).c2<V^8dQh/S[;R&S[;R&#)r)kindr:r)r,rQs"r-r._LadderStep.__annotate__ks I K r/rDNrrPs@r-r r ks]r/r auth errorzmodel incompatible with routezinvalid provider responsezstructured provider errorrequest timed outzconnection errorcTV^8dQhR\R\\.\3,/#)r)stepaccept)r rrrm)r,s"r-r.r.s&   Xyk4.?%@ r/c#r"VxpVR3# \dpT!T4'ghRT3uRp?#Rp?ii;i5i)zOne ladder rung: perform ``step``; yields ``(response, None)`` on success, ``(None, exc)`` when ``accept(exc)`` lets the next rung handle it, else re-raises.N)r)r r r_rcs&& r-_rungr sD 4< c{{ Sys$7 7 4/4747c0V^8dQhR\R\/#rorp)r,s"r-r.r.s22Y242r/c\V4;'g\V4;'g\V4;'g\V4;'g\ V4;'gR\ V49;'goR\ V49;'gY\ VR4;'gE\V4;'g2\V4;'g\V4;'g \V4#)a*After a parameter-strip retry: fall through to the max_tokens/payment/auth chains with the stripped kwargs; re-raise anything those chains won't handle. A 429 on the retry is the credential/provider-fallback rungs' job, so it falls through too (the pre-ladder max_tokens rung accepted rate limits).r#unsupported_parameterr%) rzrrrrrXrrrrrrs&r-_param_rung_acceptsr s c " 1 1&:3&? 1 1>RUCV 1 1#C( 1 1,TUX,Y 1 1s3x' 1 1+Bc#h+N 1 1 /sMB 1 1-S1 1 16VVY5Z 1 1/s3 1 1,C0 2r/c0V^8dQhR\R\/#rorp)r,s"r-r.r.sVV)VVr/cd\V4;'g\V4;'g \V4#r8)rrzrrs&r-_credential_rung_acceptsr s* #  U U"3C"8 U U**c3h((e_r/rDNrrPs@r-r r rr/r cFV^8dQhR\R\\,/#r^r)r,s"r-r.r.s"hhh(4.hr/czRV9d.VP4UUu/uFwrVR8wgKWbK upp#R#uuppi)zACopy *kwargs* without ``temperature``; None when it was not sent.r%Nrr;rrs& r-_without_temperaturer s;FSW]F]V\\^ B^TQqM/ADAD^ Bgcgg Bs 77c0V^8dQhR\R\/#r^rT)r,s"r-r.r.saaaar/chVP4UUu/uFwrVR9gKWbK upp#uuppi)uaCopy *kwargs* without either output cap. Unlike the other strips this never returns None: a route can translate the caller's cap into a field the wire kwargs no longer show (Codex Responses), and the provider's own gateway may inject one — the 400 still names ``max_tokens`` and the identical request completes on retry (registry class #89897/#90257).)r#r$r r s& r-_without_max_tokensr s0 $\\^ `^TQq8_/_DAD^ `` `s ..c<V^8dQhR\R\R\/#)r)rcrr*)rrrm)r,s"r-r.r.s&YY)YSYTYr/c\V4pRV9;'dR\\VRR449pRV9;'g$RV9;'g\VR4;'gT#)1210bigmodelrVrjr#r )rXrqr)rcrerr_stris_zai_param_errors&& r-_is_max_tokens_rejectionr s|#hG 7*aazSQ[]_A`=a/a G # X X'>''I X X.sLA X XEWYr/cRV^8dQhR\R\\,R\/#)r)rr#r*)rrrWr)r,s"r-r.r.s%Shsmr/caaR\R\3\\R\3\ \ R\3\\RR3VV3Rl\RR33#) a Ordered ``(matches, strip, log message, remember)`` parameter rungs; ``strip`` returns None when the field was not on the wire, so an unchanged request is never re-sent; ``remember`` (optional) records the rejection per route so the next call omits the field up front.c\VR4#)r%)rrs&r-r"_parameter_rungs..s 4S-Hr/z2provider rejected temperature; retrying without itz|provider rejected the structured-output format field; retrying without it (schema enforcement degrades to prompt compliance)z9provider requires reasoning; retrying at the floor effortzRprovider rejected the reasoning field; retrying without it (route default applies)Nc4<SRJ;'d \VS4#r8)r )rcrr#s&r-rr sZt+UU0Hf0UUr/z5provider rejected the output cap; retrying without it) r rrrrrrrrrr )rr#sffr-_parameter_rungsr sm IJ^ =?] _ (*K >?c e *+? DF^ ` &(A ]_c e UWj @$ H% r/c V^8dQhR\R\R\\\3,R\ \ ,/#)r) first_errrr;r#)rr rrXrrrW)r,s"r-r.r.s:###!-#7;CH~#S[\_S`#r/c#*aa"VPVPVPrep\\ WC44pV'd\ VV3RlV4R4pVfMVP V4VwrrV !S4p \PRT;'gRWkS4Sp\\RWM34\4RjxL wpoSf=V e4T !VPVP;'g VPSV4VRV 3#V oKRSS3#LP5i)aParameter rungs: retry without temperature / structured-output format / reasoning field / max_tokens. Rungs chain in whichever order the provider raises them (reasoning models reject temperature AND max_tokens; a reasoning-strip retry can then trip temperature, #78273), each field stripped at most once, so a request with N rejected fields recovers in N retries. Returns ``(response, None, kwargs)`` or ``(None, narrowed_err, stripped_kwargs)``.c3|<"TF1pV^,!S4'gKV^,!S4fK-VxK3 R#5irrD)r#rungr r;s& r-r%*_ladder_parameter_rungs..s5KUTAwy).21gfoDUs << <NzAuxiliary %s%s: %s: %sr_)rrBrrr r removerr+r r r rr r4)r rr;r#rrBrrungshit_matchesrrrememberr rejectionrespsf&f& r-_ladder_parameter_rungsr s ejj%))#F !&5 6E KUKLPR ;  S-0*V}  ,dnnfcIV %*  6 79L&NNi  #00%//2\2\UE\E\,|+ + F ""Ns$?DAD)DD.D0"Dc V^8dQhR\R\\\3,R\R\\ ,/#)r)rr;rr*)r rrXrrr )r,s"r-r.r.s7;; ;d38n;s;W_`kWl;r/c \VP;'gRVPVPVPVP VP VPVPVPVPR8HR7 wr4VfR#\PY P;'gRVP4V'dWAPR48wdWAR&\RW134#)zNRebuild the Nous client after a credential event; None when nothing refreshed.rr) r rr r rrVrUrorrNr_r)r rr9r3rBrr4r5r6rrr+rrr )rr;rrefreshed_clientrefreshed_models&&& r-_refreshed_nous_stepr s(F..88&@Q@Q))uzzeN^N^((%2H2H((u7I7I::) )% KK--vuyy9?jj.AA)w v 09 ::r/cjV^8dQhR\R\R\\\3,R\ /#r)r rr;client_is_nousrr rrXrrm)r,s"r-r.r.s4%%%!-%7;CH~%W[%r/c# "VPVPVPrep\V4'dV'd\ VR8HVP R4R7pV'duWrP R48wd`\ PRT;'gRWbP R4V4WrR&\\RWB34R4RjxL wrVfVR3#\V4'dHV'd@\4'd0\WR4p V e \V R 4RjxL wrVfVR3#\V4'd8V'd0\WR 4p V e \V R 4RjxL wrVfVR3#RV3#LL\L5i) zNous-only rungs: stale-model self-heal, paid-account refresh, 401 refresh. Returns ``(response, None)`` or ``(None, first_err)`` to fall through.rr)rr2z]Auxiliary %s%s: model %r no longer in Nous catalog; retrying with refreshed recommendation %rr_cR#)TrDrs&r-r$_ladder_nous_rungs..&sbfr/NzUAuxiliary %s%s: refreshed Nous runtime credentials after paid account check, retryingc>\V4;'g \V4#r8r rrs&r-rr 0":3"?"\"\CWX[C\"\r/zFAuxiliary %s%s: refreshed Nous runtime credentials after 401, retryingc>\V4;'g \V4#r8r rs&r-rr 8r r/)rrBrrr6rrrr r rzrr r) r rr;r rrBr healed_modelr r s &&&& r-_ladder_nous_rungsr s{  ejj%))#F!++6H$6::g3FH LJJw,?? NNG>>63 70C\ S+7O).{6FCS/TVf)ggOD Tz!##;e;g;g#  ce  ).\*^^OD Tz!i  ^# ce  ).\*^^OD Tz! ?+h^^sM &F30F#F$&F F+F,FFFcjV^8dQhR\R\R\\\3,R\ /#r r )r,s"r-r.r.>s4===!-=7;CH~=W[=r/c # "VPVPVPVP3wrErg\ WqP \ VR44p\V4'dVR 9dV'gVR8XdR\VRR4/M/p \V3/V B'dV\V48wd \V4\PRT;'gRWh4\RYP;'g VP 34p \#V R 4RjxL wrVfV R3#\%WtVP&R 7p \)\VRR4;'gR4p V 'd\+V4'dTp\-V4'd?\/V4'g.\#\RWB34\*4RjxL wrVfV R3#\1WV R 7'dR\PR T;'gRWl\3V4P44\RWqP34xR3#RV3#ELLy \6dOp\/T4'g#\T4'g\-T4'd\1Y4TpRp?RT3#hRp?ii;i5i)zOAuth credential refresh + same-provider retry, then credential-pool rotation. Returns ``(response, None)`` or ``(None, first_err)`` to fall through.rjNr<r#rUzCAuxiliary %s%s: refreshed %s credentials after auth error, retryingr_retry_same_providerc>\V4;'g \V4#r8r rs&r-r*_ladder_credential_rungs..Ur r/r )r#zBAuxiliary %s%s: recovered %s via credential-pool rotation after %s>Nrjr)rrBrrrr r>rrqr{rrrr+r r3r9r r"rrXr rrzr1r+rHr)r rr;r rrBrrauth_refresh_providerrr r pool_provider_client_api_key recovery_err retry2_errs&&&& r-_ladder_credential_rungsr >s ,1<<UYYPUPgPg+g(F#<??,J6SU,VXy!!&;CU&U"2kA,WVY-KLGI  ()> Q. Q Q$(?@Q(RR&&78 KK] D%&(<(<(Q(Q@Q@QRTD*/\*^^OD Tz! //@W\WiWijM'&)R8>>B?O1)<<  * *3DY3O3O,1FV$457O-Q"Q D#Tz! !-o ^ ^ KK\DGS3-03IM 8C=(3- ,-r/c *Rp\Y;'gRWtVPVR7pV'dV#V^,f,V'd$\Y;'gRWtVPVR7pV^,f#\WWsPWSPR7pV#)uWNext candidate after a fallback entry was quarantined mid-request (dead credential or a capacity error): remaining configured entries (task chain, then main chain on auto) before the discovery chain. ``task_chain_only`` (explicit-provider auth error) stops at the task chain — the user never opted that task into discovery or the main model.zfallback candidate unavailablerrr,rrrrrr)rbr rrr*r) rBrr rr,rr rfbs &&&&&&$ r-_next_fallback_after_quarantiner ~s.F ' ))6&} FB  !u} % --vf!OO=J !u} " FOO'6H6HJ Ir/c0V^8dQhR\R\/#)r)r r)rr )r,s"r-r.r.s\\\<\r/c #a"VPVPVPrCpVR9p\V3Rl\4R4p\ ;QJd#V3Rl\4F 'gK RM RM!V3Rl\44pV'd\ V4PR4MRp\V\4;'d \V4p VR 8H;'dV'*;'dT p VeV'gV'g V 'gR#VR 8XdA\\WAPVPR 7;'gTVPR 7VR 8XduR\!S49p \"P%RT;'gRY1P;'gTV 'dSMRVP& R2T;'gRV 'dRMRV4M#\"P)RT;'gRW6VS4VR9dRM VP*p ^RIHp VR 8Xd(\1WAP4'd V P2MRp\5Y$;'gRWlVPVR7wpppVf[V'dS\7Y$;'gRWlVPVR7wpppVf'\9WBWaPWPR7wpppM)Vf&V 'g\;WBWlVPVR7wppp\=4pVP>e\AVP>4MRpVeTT\!\CVRR4;'gR43pVV9dM]VPEV4\GVP>\IV4V4\KRVVV34xpVeV#\MW$WQWV R7wpppK\"P%RT;'gRW6V4Ve*VP>eVP>POV4R#5i)uLast rung: other providers (per-task chain; then auto: main fallback chain + discovery chain, explicit: main-agent-model net). Returns the response or None. Capacity errors (payment/quota, connection, exhausted 429, model incompatible, malformed response) bypass the explicit-provider gate — the provider cannot serve this request regardless of user intent. Auth errors from an explicit provider may only use the task's own configured fallback_chain; they never imply an unconfigured provider hop.rrjNc3L<"TFwrV!S4'gKVxK R#5ir8rDr# predicaterr s& r-r%,_ladder_provider_fallback..s [1B-YiPYFZ551Bs$ $c3J<"TFwrVR8wgKV!S4xK R#5i)r NrDr s& r-r%r s,a5F!1%S_J_ )5Fs ##TFrr rr ryr zAuxiliary chat streamzlAuxiliary %s%s: request to %s %s (raise auxiliary.%s.%s for slow or reasoning models) on %s, trying fallbackr_ztimed out after r$rrz.Auxiliary %s%s: %s on %s (%s), trying fallback)r/r r rVr)r ztAuxiliary %s%s: %s on %s and all fallbacks exhausted (fallback_chain + main agent model). Raising the primary error.>Nrjr)r r)(rBrrr _FALLBACK_REASONSr3rGrr?rrmrr"rrr rXrrrr+r9r9r/rENDPOINTrbrrr*rHrbr|rrqrrrr r r)r rrBrrr ris_capacity_error task_chainhas_task_fallback_chainexplicit_auth_with_task_chainstalled_chain_failed_modelr/_chain_failure_scoperrr tried_lanes primary_router.fb_respsf& r-_ladder_provider_fallbackr s$)::uyy%:Q:Q D #55G [1B[]a bFa5Faa5FaaKO+D1556FGUYJ(T:OOtJ?O,JJw;JJ3J"~g):>[   ! &'8,,UZUgUg h ! ! 5?? <$$*S^;89=ooNrNrar$+y3CEMM?RS1TVZVdVd^d07,YHY [  DNNFC1BI O #),K"K$QVQbQb3 _ $)@ARTcTc)d)d   %C ))6&7K%M!IxW(@ --vf!OO;O)Q% 8X  ,A!2ASAS-U )Ix  #@(F F!OO;O)Q% 8XuK.3.>.>.JD))*PTM  (C :r(J(P(Pb$QR ;  5++-J8-TV^_#JHh0OPP  N(G W5H9);% 8X NNU>>630AC U%5%5%A  . sA&O5,#O52O5O5O5*O59O5O5 A6O5O5 O5O59 O5"O5&A"O5 $O5. O5* - 9Ac3h8P -r/c#("V'dRMRp\WWWVVWWWVPR44p\VVW,4RjxL wprVfV#VR8H;'g \VR4p\ VVVV4RjxL wppVfV#\ VVVV4RjxL wppVfV#\ VV4RjxL pVeV#\V4'd\V4VhVhLLiLLL1 \d\PRTRR 7Thi;i5i) u\Ordered recovery rungs after the primary request failed (generator): parameter strips → Nous heal/refresh → credential refresh/pool rotation → provider fallback. Each rung returns a response, narrows ``first_err`` and falls through, or re-raises. Raises the narrowed ``first_err`` when exhausted (after evicting a connection-poisoned client).rrjrNrinference-api.nousresearch.comz9Auxiliary%s: cache eviction after connection error failedTr) r rr rr r r rr,rrr)r rr;rBrr rr3r4r5r6r9r#rr|rrr r s&$$$$$$$$$$$$$$ r-_aux_recovery_ladderr sL#*C cy^->\ 9 E*AESY)ffD) '61\\.y:Z[!3Iufn!]]OD) !9)UFTb!ccOD) / 5A AD  I&& - )& 1 O)O;g ^d B - LLTt  - O  -sq>DC DD8C"9DC$D4C&5D C(D"D$D&D(#D DDDcTV^8dQhR\\.\3,R\/#r)performr*rr r)r,s"r-r.r.&s&  8[M3,>#? C r/c\V4pV!V4pVPV4pK \dpTPT4pRp?K?Rp?ii;i \dpTP uRp?#Rp?ii;i)zJRun a ladder generator, feeding each step's result (or exception) back in.Nr sendrthrow StopIterationrQladderr r r_rcrYs&& r- _drive_ladderr &sl F| + {{6* )||C( ) zzsB A*A AA A AA A5 A0*A50A5cTV^8dQhR\\.\3,R\/#r r )r,s"r-r.r.5s'  x s8J/K PS r/c "\V4pV!V4GRjxL pVPV4pK%L \dpTPT4pRp?KIRp?ii;i \dpTP uRp?#Rp?ii;i5i)z=Async twin of :func:`_drive_ladder` (``perform`` is awaited).Nr r s&& r-_drive_ladder_asyncr 5st F| +&t},{{6* - )||C( ) zzs`B A 646A 6 AAA AA B+ A<6B7B<BBcRV^8dQhR\R\\,R\/#)r) started_atrar*)rOrrW)r,s"r-r.r.Ds*YYEYY3Yr/cz\^\Vf\P!4MTV, R,44#)z7Whole milliseconds since ``started_at`` (clamped at 0).i)rrWr=r>)r! ras&&r- _elapsed_msr# Ds, q#CK(SJNRVVW XXr/cxV^8dQhR\\\\3,,R\R\RR/#)r) latency_inforr! r*N)rrrXrWrO)r,s"r-r.r.Is744htCH~&>4S4V[4`d4r/c<VeW9d\V4W&R#R#R#)z;Record ``key`` in ``latency_info`` the first time it fires.N)r# )r% rr! s&&&r-_stamp_latency_oncer' Is"C$;' 3 %<r/r%r#rirr{r(rr/ r|r% c)V^8dQhR\R,R\R,R\R,R\R,R\R,R\\\\3,,R\R \\ ,R \ R,R \R,R \ R,R \R,R\\,R\\\\3,,R\R,R\R\R,R\\\\3,,R\\\\ 3,,R\/#)r)rBNrrrVrUrrmr%r#rirr{r(rZrorr/ r|r% r*rXrrrrrOrWrm)r,s"r-r.r.Ps:/ / */ *-*/ DG$J/ adgkak/ 4Z/ .6tCH~.F/ Y]/ %/ 694Z/ PTVZ{/ T\ / /3Tk / U]]aTb / DcN+ / ?BDj / Z^ / 4K / 5=T#s(^4L / 4S>*/  / r/c\P!4p\V4pVeVP4\P!4pVe\ VV4VR&\ \ RR4p\V4;_uu_4\\V4'dTMVeRMR4;_uu_4\\\P!\VRV44;_uu_4\\\P!\VRV44;_uu_4\!R/RVbRVbR VbR VbR VbR VbR VbRVbRVbRV bRV bRV bRV bRV bRVbRVbRVbRVbpRRR4RRR4RRR4RRR4V'd<Ve8TpRp\#XV4Ve\ V4VR&VeVP%4##XVe\ V4VR&VeVP%4## +'giL;i +'giL;i +'giL;i +'giL;i Te\ T4TR&TeTP%4ii;i)zARun an auxiliary LLM request, applying the configured task limit.N queue_wait_msrcR#r8rDrDr/r-rcall_llm..hstr/provider_dispatch_mstime_to_first_progress_msrBrrrVrUrrmr%r#rirr{r(rZrorr/ r|summary_generation_msrD)r=r>rx acquirer# rqrrrLrrJrropartialr' r _call_llm_impl$_release_sync_semaphore_after_streamrelease)rBrrrVrUrrmr%r#rirr{r(rZrorr/ r|r% queue_started_at semaphorerequest_started_atprior_progress_hookrstream_semaphores&$$$$$$$$$$$$$$$$$$ r-call_llmr; Os~~'+D1I)(34DFX(Y _%!->  - - /00$(4(@|d   #=)2C2C#\3IK]3_ ` ` "#99;L;L#\3NPb?/r/c T\V4p\V3/RVbRVbRVbRVbRVbRVbRVbRV bR V bR V bR V bR V bR VbRVbRVbRVbp\WWV VPVPV R7p\VVP VP VPVVPVR7pVVV3#)a;Shared head of both call impls: prepare the request and bundle the kwargs the recovery drivers pass to ``_retry_same_provider_*`` / ``_call_fallback_candidate_*``. One immutable runtime snapshot for keying/resolution/retries/fallbacks, so a concurrent /model switch can't mix key and client from different runtimes.rrrVrUrrmr%r#rirr{r(rZror|r)rBrmr%r#rir7r8r()r4r5r6rr9rZ) rr rr7r8r4r5r6r9)rBrrrrVrUrrmr%r#rirr{r(rZror|rcandidate_kwargsrs&$$$$$$$$$$$$$$$$ r-_plan_aux_callrA s+<8L    ', 7? IP ! ,4 BM  &+ 5< IS *  :G      '1   >H  C +s'<'< 55HX C,A,A--AVAV!smL  . ..r/c^V^8dQhR\\,R\R\R\/#)r)rBrcrr*r)r,s"r-r.r.s-  hsm ) # RV r/c\V4'gR#\W4'd\PRWV4R#R#)zTrue when ``exc`` is a transient transport blip worth a same-provider retry; critical-path tasks skip it on a full-budget timeout (``_should_skip_same_provider_retry``) and go straight to fallback.Fz_Auxiliary %s%s: timeout on the critical path; skipping same-provider retry and falling back: %sT)rrrr+)rBrcrs&&&r-_should_retry_same_providerrD s< ) - -'22 HIMTW Y r/cV^8dQhR\R\R\\\3,R\\\3,R\ \\ \\\3,3,/#)r)r rrr@ r*)r r rrXrr)r,s"r-r.r.s\ 3 3  3/ 3?CCH~ 3aefiknfnao 3 3tCH~ %& 3r/cVPR8Xd/RVP\VPVPR73#VPR8XdVPwrERR\W$VR73#RVPV3#)zQResolve a ladder step into ``(kind, args, kwargs)`` for the sync/async performer.r_rr r)rr3rrD)r r:rrr6)r rrr@ retry_providerrDs&&&& r-_ladder_step_callrH su yyFtyy$0E0EPSPePe"fff yy))&*ii#D`klll tyy"2 22r/cV^8dQhR\R\R\\\3,R\ \,R\ R\ \\\3,,/#)r)r rrrBrr|)rr rrXrrrm)r,s"r-r.r.s] J J J2 JBFsCx. J 3- J%) J7?S#X7O Jr/c\WPVPW4VPVPVP VP VPVPVPVR,VR,VR7#)zABuild the recovery-ladder generator for a failed primary request.r#r)rr;rBrr rr3r4r5r6r9r#rr|) r rr;r rr3r4r5r6r9)r rrrBrr|s&&&$$$r-_start_recovery_ladderrK sk **SZZd--33H3H))S=R=R--AVAVOO \0J!.1j  JJr/c'jV^8dQhR\R,R\R,R\R,R\R,R\R,R\\\\3,,R\R \\ ,R \ R,R \R,R \ R,R \R,R\\,R\\\\3,,R\R,R\R\R,R\\\\3,,R\/#)r)rBNrrrVrUrrmr%r#rirr{r(rZrorr/ r|r*r) )r,s"r-r.r.s8ZZ *Z*-*ZDG$JZadgkakZ 4ZZ.6tCH~.FZY]Z%Z694ZZPTVZ{ZT\ Z/3Tk ZU]]aTb Z DcN+ Z ?BDj Z Z^ Z 4K Z 5=T#s(^4L Z Zr/c Vaaaaaaa \S3/RRbRVbRVbRVbRVbRVbRVbR VbR VbR V bR V bR V bRV bRV bRVbRVbwoo oSPSPSPuoooV'doRSR&V'dVSR&SR8Xd=\ S\ 4'd'SP PP!R#/SB#\SSSSPR7#RVVVVV3RllpV!SSPR7# \dp\STR4'gh\4pTp\^T^,4Fp\!\"RT^, ,,R4p\$P'RS;'gRTTTT4\(P*!T4T!4uuRp?# \d p\-T4'ghTpRp?KRp?ii;i ThRp?ii;i \d2pR TTT T3R!llp\/\1TSS SRTR"7T4uRp?#Rp?ii;i)$aCentralized synchronous LLM call: resolve provider/model, auth, kwargs, fallbacks. task: aux task whose provider:model comes from config (ignored if provider set); api_mode overrides task config; timeout=None reads auxiliary.{task}.timeout; extra_headers override client defaults. stream=True returns the raw SDK stream (caller consumes/falls back) instead of a validated response. RuntimeError if no provider is configured.rFrrrVrUrrmr%r#rirr{r(rZror|Trr/ rg rc0V^8dQhR\R\/#r) validate_kwr*r9)r,s"r-r.$_call_llm_impl..__annotate__s    r/c \<\\SSSSPVVVV3RlR7S3/VB#)c r<\STS\SSP;'g SP4R7#r)rrr r4)rrrr rBs&r-r2_call_llm_impl.._primary.. s2'<GT!:(#--*P*P3;P;P"R(r/r)rJrr6)rP rr;rr rBs,r-_primary _call_llm_impl.._primarys>& ")9CDYDY       r/rhrjg@g @zoAuxiliary %s: transient transport error (attempt %d/%d); retrying same provider after %.1fs before fallback: %sr_Nc0V^8dQhR\R\/#r)r r*r r)r,s"r-r.rQ ( s > >; >3 >r/c<\VSSS4wrpVR8Xd\\V/VBS4#VR8Xd \R/VB#\ V/VB#)r_rrD)rH rJrrLr)r r r:rkr@ rrrBs& r-_perform _call_llm_impl.._perform( s].tS,HXYNDv~-.Dd.Qb.QSWXXw062660$="= =r/rBrr|rD)rA rr;r r?rrrrrr6r rrD rranger_TRANSIENT_RETRY_BACKOFF_BASErr+r=sleeprr rK )!rBrrrVrUrrmr%r#rirr{r(rZrorr/ r|rU transient_err_max_transient_retries_last_transient_attempt_backoffretry_transientr r[ r@ rr;rr rs!f$$$$$$$$$$$$$$$$$ @@@@@@r-r3 r3 sw+9 ++)1+9>+IQ++&2+=E+ +-7+?D+NU+ +1A + $ + /7 + DN +'C'(+zz3::s?S?S$FF$x '5F# $ # # 6;O(P(P;;**11;F; ;!&&;KVYVkVkll  ." "%5 N N ".t]BGG%;%= "+O!!%;a%?@<ST @UVX[\ U NNFH6LhXgi 8$6#:% 68II&5O6A" !# "$   > > "9cGG$GG$$G))G,, H(7&H#H(#H(cVe\V\4'dV#\V\4'd&RV9dV#VPR4;'g.pM\ VRR4pV'gV#V'd\ V^,R4#R#)zPull a message (dict, object, or str) out of a response-or-message value: dict-shaped responses/bare messages (compression, proxies) and ChatCompletion objects; MagicMock ``reasoning_*`` attrs are deliberately not strings.Nrr)r?rXrrrq_message_field)rrs& r-_coerce_llm_messageri 4 sy:h44(D!! H $O,,y)//R(It4O4;>'!*i 0EEr/ch\V\4'dVPV4#\WR4#r8r)rr`s&&r-rh rh E s(&sD113774=Ows$7OOr/max_reasoning_charsc>V^8dQhR\R,R\/#)r)rk Nr*)rWrX)r,s"r-r.r.I s,,3:,Y\,r/c\V4pVfR#\V\4'dVP4#\ VR4p\V\4'gV'd \V4MRpVP4pV'd>^RIHpTpVFpVPRV4pK VP4pV'dV#.pR Fop \ W)4p V 'gK\V \4'gK0V P4'gKHW9gKPVPV P44Kq \ VR4p V 'd\V \4'dV Fp \V \4'gKV PR4;'g+V PR4;'gV PR4p V 'gKhW9gKpTP\V \4'dV P4M \V 44K V'gR#RPV4pVe6\V4V8d&\PR \V4V4VRV#V#) uExtract content from an LLM response, falling back to reasoning fields. Order: ``content`` (inline think blocks stripped) → ``reasoning``/``reasoning_content`` → ``reasoning_details`` (OpenRouter array). Accepts a response or bare message; ``max_reasoning_chars`` bounds a reasoning fallback so unbounded chain-of-thought can't become the compaction summary. Returns ``""`` if nothing found.Nrjrn)_REASONING_BLOCK_PATTERNSrJ rr-z z:fell back to reasoning fields (%d chars); truncating to %d)r}rk )ri r?rXrrh rrn subrrrrrrrr)rrk rrrnrn cleanedpatternrI r8rdetailsrY rr-s&$ r-extract_content_or_reasoningrs I s h 'C {#syy{ i (C c3  c#h2iikGI0Gkk"g.G1--/ N!#O3S( 3:c3''CIIKKCV>V7==?\_`g\hi   ;; 'D&3t97J+JS4y"5 7(()) Kr/cV^8dQhR\R,R\R,R\R,R\R,R\R,R\\\\3,,R\R \\ ,R \ R,R \R,R \ R,R \R,R\\,R\\\\3,,R\/#r)rBNrrrVrUrrmr%r#rirr{r(r|r*rXrrrrrOrW)r,s"r-r.r.y s  * *-* DG$J adgkak 4Z .6tCH~.F Y] % 694Z PTVZ{ T\  /3Tk  U]]aTb  c3h(    r/c "\V4pVeVP4GRjxL \V4;_uu_4\WW#VWVVWWWR7GRjxL uuRRR4VeVP 4##LSL% +'giM;iTeTP 4R#R# TeTP 4ii;i5i)zERun an asynchronous auxiliary LLM request under the configured limit.N)rBrrrVrUrrmr%r#rirr{r(r|)r} r1 r_async_call_llm_implr5 )rBrrrVrUrrmr%r#rirr{r(r|r7 s&$$$$$$$$$$$$$ r-async_call_llmry x s-T2I!!!   . .-EV])+%G!1 / .      ! "/ . .      !9     !sU#CA9CB)A=A;A= B)#C;A== B B)C)CCcV^8dQhR\R,R\R,R\R,R\R,R\R,R\\\\3,,R\R \\ ,R \ R,R \R,R \ R,R \R,R\\,R\\\\3,,R\/#ru rv )r,s"r-r.r. s77 *7*-*7DG$J7adgkak7 4Z7.6tCH~.F7Y]7%7694Z7PTVZ{7T\ 7/3Tk 7U]]aTb 7 c3h( 7  7r/c aaaaaaaaa"\S3/RRbRVbRVbRVbRVbRVbRVbR VbR VbR V bR V bR V bRV bRRbRRbRV bwoooSPSPSPuooo\ SSP ;'g SP 4oRVVV3RlloRVVVVVV3RllpV!SSP R7GRjxL #L \dPp\STR4'gh\PRS;'gRT4T!4GRjxL uRp?#Rp?ii;i \d;pRTTTT3Rllp\\TSSSRT R7T4GRjxL uRp?#Rp?ii;i5i)zCentralized asynchronous LLM call; see call_llm() for full documentation. No per-request header / api_mode override on the async entry point.rTrrrVrUrrmr%r#rirr{r(rZNror|cRV^8dQhR\\\3,R\/#)r)_kwargsr*r )r,s"r-r.*_async_call_llm_impl..__annotate__ s& i iDcN is ir/c><"\SVSSR7GRjxL #L5i)rNr)r} _force_stream_asyncrrBs&r-_acreate&_async_call_llm_impl.._acreate s/Tghh hhs c0V^8dQhR\R\/#rO r9)r,s"r-r.r~ s % %# %# %r/c <"^RIpVP!\\SSSSPSR7GRjxL S3/VBGRjxL #LL5i)rNr)rrrJrr6)rP rr rr;rr rBs, r-rU &_async_call_llm_impl.._primary s]  **&-F-=H]H]#%% % $ %% %%%s!3A A A A A  A rhrzgAuxiliary %s (async): transient transport error; retrying once on the same provider before fallback: %sr_c0V^8dQhR\R\/#rX rY )r,s"r-r.r~ s ] ] ] ]r/cT<"\VS S S 4wrpVR8Xd5^RIpTP\\ V/VBGRjxL S 4GRjxL #VR8Xd\ R/VBGRjxL #VwrVp\ YV;'gRS R8HR7wrX\WVV3/VBGRjxL #LaLVL>L 5i)r_NrrjrrrD)rH rrrJrrOrr) r r r:rkrrrrrr@ rrrBs & r-r[ &_async_call_llm_impl.._perform s.tS,HXYNDv~$../EMdfjMqnpMqGqswxxxw7="===,0 )I+I~~2RVZbRbdLI7 X\Y[\\ \ Hrx=]sE;B(B B( B" B(%B$&5B(B&B("B($B(&B(r] ) rA rr;r rr r4rrD rr+r rK )rBrrrVrUrrmr%r#rirr{r(r|rU ra r r[ r r r@ rr;rr rsf$$$$$$$$$$$$$ @@@@@@@@r-rx rx s+9 ++(0+8=+HP++&2+=E+ +-7+?D+NU+ +1A +  + &* + 7A +'C'(+zz3::s?S?S$FF$&88H#--JpJp[^[p[pq i i % % $!+;cmmTT TT $.t]JOO KKHIMQWYf h!## #  $   ] ]) "9c(k\+*s*]^-,,_`.-#-ab,++cB.-htCH~&-CR$#&#SX*)c)YvewFUGntCH~oDUTd38nTEJ?>9>KfZYc3hYgLTS9SM| 4}vF3wFPO!  QOROSSOTO!  UOVO sWOXO!  YOZO"!![O\O{--htCH~.FG]OdO//c3h0HIeOHUJIuS#XIIU^b,+d3:&+_b`b0/$sEz*/abbb+*tCH~*cbNyS(39"556OyxhT#x0A>0Q'R"RSyhVmc8Xc]OU8C=RZ[^R_C_=`,`#aabWmls'&tE5L!&ms~HYXd5c?E#y7Q7Q2Q,RRSXH@IHGtE#sC-0%S/ABGAIfk  5x T(9:C?@#EF gkr/)TNNr8r)zgpt-mini-latestzgpt-nano-latestzclaude-haiku-latestzgemini-flash-latestz gpt-5.4-nanoz gpt-5.4-miniz gpt-5-miniz haiku-4.5rz flash-litez-nanoz-miniz-flashhaiku)r.rz-r1minilmz:batchrzo1-zo3-zo4-raudioz-vlembedz-ttsz -transcribez -realtimez-imagez-search-preview)z minimax.ioz minimax.chatz minimaxi.com)z api.minimax.rrrIr)rrrVrUror)rrr)rrcan only affordr isn't available on the free tierzkey limit exceededz budget limitzrequires a subscriptionzupgrade for accesszupgrade for higher limitsz reached your session usage limitzquota exceededquota_exceededztoo many tokens per dayz daily limitztokens per dayz daily quotazresource exhaustedresource_exhaustedzresource-exhaustedresourceexhaustedzweekly usage limitz weekly limit)r rate_limitztoo many requestsz try againz retry afterz resets in) rrrrr rzrun out of fundsrrrrr >rrr?)z chatgpt.comr)rrcr rrr<)rgr)rr9zapi.x.air))r rr r r r )Nr)NrNrjNri)rN)rjr) NFFNNNNFN)rcrrU )z$https://open.bigmodel.cn/api/paas/v4zhttps://api.z.ai/api/paas/v4)NFNNNNFN)NNNNN>minimax minimax-cnr+ )imagez image/png)videoz video/mp4> thinkr.r} verbositythinkingbudgetthinkingconfigenable_thinkingthinking_budgetthinking_configr>r nousresearch nous-portal>nimnvidianemotron nvidia-nim build-nvidia>r7google google-geminigoogle-ai-studio) NNNr5 NNNNN)rr.rnr-(Dr rLrrnrorr rrrmrrr=rbtypesrtypingrrrrrrr r r r r r ragent.local_prompt_progressrrrrragent.error_classifierrrrrragent.auxiliary_managed_localrr rrr rrragent.codex_headersrrr rr!r.r"rrr#rr$r2r&r1r4r6rrrrSrscontextmanagerrvrrwagent.custom_entry_poolrxryagent.message_metadatarzrr{r|rr}hermes_cli.config_providersr~agent.auxiliary_healthrrrragent.auxiliary_unavailablerrrrrr@ rrutilsrrrrrrr getLoggerrHrrbrC rE r: r rrrrrrarrrrrrrrrr rRrrrr rrrr5rErrJrLrDrXrvr|rrrvrrrrrrrrrrrrrrrrrrrr#r$rr+r6r2r r rFrIrNrQrArlr^rsrxrzhermes_cli.version_infor{ base_version_AI_GATEWAY_HEADERSr r}rrr,rr-rr?rrrrrrrrrrrrrrrrrrr$rrRrrr!_AsyncAnthropicCompletionsAdapterrrrrrArKrMr_rjrmrwrrrrrrrrrrrrrrr rrr0r6r>r2 rNrrTrSrKrOrWrrrrrrr rrargrrrvrzrrrrrrrrrrrrrrrrrrrr#r(rr0r:rrrDrrJrSrTr\rUrNrPr`WARNINGrrrbrfrmrwrzrrrrrrrrrrr_ rrrrrrrrrrrrrrr,r rrrrr"r1rFrLrOrSr\rardrmrpruryr{rrrrrrrrrrrrrrrrr*r rHrLrPrXrbrgrVr]rrryr}rrrrr>rr7rrrrrrXrrrrrrrrrr r r r r r r$ r' r+ r6 r= rG rM rCrT rq rBr] ra rk rm rt ry r r r r<r r rrr r r r r r r r r r r r r r r r=r r% r# r$ rS _DEFAULT_AUX_TIMEOUTrY agent.auxiliary_task_configrGr7 rC rJ rM rrS rV r[ rc rh rw r{ rq rl rr rx r} r r r@r rArr r r r r r r r r r r r r?rJr rrer r r r r rr rcompile IGNORECASEr r" r! r% rr0 r* r7 r[ r> r| r r rr r r r r r r r r r r r r r r r r r r r r r r r# r' r; r4 rA rD rH rK r3 ri rh rs ry rx r.)r s@r-r s   !___77qqEZBB 9H $(( , ,  ??$66$< '',L7Q-;DDBfff   8 $ &)U*'*u,(+ -&)e+ !&AeA*@8&OO-KMKEQ  CC&.006! ! "*!(A* * <  <++ 0+/'   1  ..*<%~ h*h; *. -"?("8#< 6 :+/'$(!``*^ MM ^%(E)r >>$(,(^:|!!N  %-I` !13J 1;@[)>;K]\c)>;P ':M 9%0UT )*<)=>>R,4[%*YY  (1-AQ1R'SS; ~7(<7 F} 5; ~L!1!3!@!@ ABD)   =' D9!#k1+b)W%(9%Z<== ," . ."()<(=>  /"WQ-dTdTNfKfKR##DD::(%=! " " 9 H,pKpKf   $= &&R    ";  k+[+[\D #E##L"HL2 FJ&0IX@7<@JO@@0 M ( $$N44(DLDLNII"%4$$%5wN''(8*t[_`&&'7US''(8*uU&  4!     !!3TB 14@  --*>>11";?&$CG$$RV$$NCGRV<CG`d42JI%NN,66 3 3KK<>PR')<>RT@   ++<< $8$8N &"#g#gL;;.@@ ;;,6"6FJ6'+6GK66r7c7ct]37  6!)++-//(**,.NNNG^  22!9MQ/>Eoo.    IM   ""--&) AA x x N N"mm NN #** ` `\\||@ 2 255--&(0jjZZ4$$QRpp))$$6/PT//6 ",,^&SU&&R)&/3)&)&X  ==VV    Z Zmm+^=W %{4R/;V: "   ' ' 6 6  M MII : E E OO    .!R!RH ? ?#% ??C ? ? *>>B22j$$48$cg$$NQS()7)7vEE = =>8=>>(114811hYY(( """7"&7?A7X\77t&&&ZZ4-=-=`  0""<-.-.`++@,,^4 j x}hsm3477!!$&c&cRnn''ee'',ee33(>>,nnEEP U UK3K3\\\0<3<3~%%PF , 0* $ WV)V)vZ^B 8 8--NNV< P`/1 2fCC ( 7 7-1-1`>c*L^b*L!*L6;*L.2*L*LZ;; !T ! !*%' &^^%$$$QBFQ!Q=AQ.2QFKQ Q8< QQ*@@$GkoGG$^b$!$=A$.2$FK$#' $FJ $$N   ..))>%U%%4>>*77 # #H?H?f&  6&JAJAZ&+" CB/*/**,^b,%),TX,,$`` (03Gff//8LWYXEGG  ( (qq s s&&((RS__'(> Mcd> !!HI88U Y  ,     8 8%b%bP//dGqGqT88v Y ]a   ee U U..b  $$$0%*!!$\\hh * #F V"%"$HH"a]baa2 > >5q]b5q5qp !# FJ ;?  "!KHCHCV!#FJ$``ww `]b ` `N 9Y9Yx * A)A)H*\"%6$H<(+GIh*i#%@A-/JK+,/CEW.X J   22"VV :"hh aaYY6##B;;"%%P==@PU2\\~--`    YY 44 / 7;/ QU/ nr/ / IM/ $(/ CG/ ^b/ ! / =A / fj / /3 / LP / af / #' / PT / .2/ / / d   //B   3 3 J JZ7;ZQUZnrZZIMZ$(ZCGZ^bZ! Z=A Zfj Z /3 Z LP Z af Z #' Z PT ZZzF"P,PT,,^ 7; QU nr  IM $( CG ^b !  =A  fj  ,0    077;7QU7nr77IM7$(7CG7^b7! 7=A 7fj 7 ,0 77r/