+ iHj2aRt!0tRt^RIt^RIt^RIt^RIt^RIHt^RIHtH t ^RI H t ]P!] 4t!RR]4t]P"!4tRs]^k]!4t]^kRRltR R ltR R lt!R R]4tRRRR/RRllt!RR]4tRRltRRltRRltRRltRRlt R#) u5Why an auxiliary client could not be built — and the Nous credential failure behind it. ``_resolve_nous_runtime_api`` must swallow the resolver's ``AuthError`` and return None so the ladder can still fall back (stored token, fallback_chain). Swallowing it at DEBUG left the goal loop reporting ``judge error: RuntimeError`` while the real cause was an ``invalid_grant`` refresh (#42177). This module remembers the latest failure so the ladder's raise and the goal judge can name it, and warns ONCE per distinct message so operators see it without debug logging. N)datetime)AnyOptional) safe_strftimec]tRt^tRtRtR#)AuxiliaryClientUnavailablezQNo auxiliary client could be built for the task (missing credentials / provider).N__name__ __module__ __qualname____firstlineno____doc____static_attributes__r@/home/ubuntu/.hermes/hermes-agent/agent/auxiliary_unavailable.pyrrs[rrc0V^8dQhR\R\/#excreturn) BaseException)formats"r __annotate__rs=rc *^RIHpHp^RIHp\ P !\4;_uu_4T!V!R4;'g/4pV'dMVPR4'd6V!\VR,4RVPR4RR7uuRRR4#RRR4\W4'dJV!\V4VPVPVPVPVPR 7#V# +'giLl;i) uPrefer the persisted terminal quarantine marker over *exc*; sentence-terminate either message. The pool rung swallows the real ``invalid_grant`` and wipes the dead tokens, so by the time the auth-store resolver runs it can only say "No access token found"; the marker it wrote still carries the message and code the user needs (#42177). ``format_auth_error`` appends the remediation sentence with a space, so an unterminated message reads "Invalid refresh token Run …". ) AuthErrorget_provider_auth_state)_terminal_quarantine_markernousmessagecodeT)providerr relogin_requiredN)r!r r" retry_after retryable)hermes_cli.authrrhermes_cli.auth_nousr contextlibsuppress Exceptionget _sentence isinstancer!r r"r#r$)rrrrmarkers& r_quarantined_nous_errorr.sC@   Y ' ',-DV-L-R-RPRS fjj++Yvi'89FQWQ[Q[\bQc.24 ( ' ' #!!3#,,SXX*-*>*>COO#&==2 2 J ( 's DD)*D D c0V^8dQhR\R\/#)rtextr)objectstr)rs"rrr6s//F/s/rc`\V4P4PR4R,#).)r2striprstrip)r0s&rr+r+6s# t9??  # #C (3 ..rcFV^8dQhR\R\\,/#r provider_idrr2r)rs"rrr:s 7 7s 7x} 7rc 6^RIHpHpHp^RIHp.p\ P!\4;_uu_4V!V4Uu.uF,p\V\4'gKVPW4NK. ppRRR4VUu.uFqfPV8wgKVNK ppV'gR#\P!4pVUU u.uF)pV!V\V4^8HR7p V fKW8gK'V NK+ p pp \V 4\V48wdR#\\ P"!\%V 44P'4R4p \V4^8XdRMR\V4 R2p R V R V R V R V R 2 #uupi +'giEL;iuupiuup pi)ukThe "all N credentials … are cooling down" error when the provider's pool is fully benched. ``resolve_provider_client()`` returns ``None`` both when no credential exists and when every pool entry sits in a 429/quota cooldown, so the raise sites could only say "no credentials were found. Run hermes auth add …" — wrong on both counts for a valid OAuth grant that is merely rate-limited (#56810). Read the persisted pool state (no seeding, no writes) and name the cooldown and its reset time instead; ``None`` when the pool is empty or a credential is usable (the caller keeps the missing-credential diagnostic). ) STATUS_DEADPooledCredential_exhausted_untilread_credential_poolNsole_credentialz%Y-%m-%d %H:%M %Zits only credential isall  credentials are Provider '' is set in config.yaml but zM cooling down after a rate limit / quota error (429); the next one resets at zC. Wait for the reset, add another credential with `hermes auth add z9`, or switch to a different provider with `hermes model`.)agent.credential_poolr<r=r>r%r@r'r(r)r,dict from_dict last_statustimelenrr fromtimestampmin astimezone) r9r<r=r>r@entrieselivenowuntilresetswhenwhichs & rpool_cooldown_messagerY:sVU4G   Y ' '0=V=qAtAT>#--k== V ( ?w!--;">AAwD ?  ))+C!4T,QD QO%',{eTF4 6{c$i //F <GGIK^ _D),Ta %T #34  %A%IFFJVL<V NKB p p \%V 4\%V 48wdR#V U u.uF+p \!V RR4R8Xg\!V RR4V8XgK)V NK- pp V'gR#V^,p\!VRR4p\'\!VR R4;'gR 4P)4p\%V 4^8XdR MR \%V 4 R 2pV'dRV R2MR pV'dRT V'd RV,MR R2MR pRV RV RV RV R2 #uup i +'giEL;iuup iuup iuup i)u-The "Provider 'X' … is out of usable credentials (402)" error for a billing-burned pool. ``resolve_provider_client()`` returns ``None`` both when no credential exists and when every pool entry has been marked exhausted — a 402 out-of-credits account, a 429/quota bench. The ``openrouter`` / ``custom`` branch of ``agent_init`` has no provider-specific missing-credentials message, so a burned pool there fell through to the generic "No LLM provider configured" setup message: actively misleading when a *different* provider is configured and working and only the session's override is out of credits (#94785). Name the provider, the session's model, the last error code and the provider's own message instead. Only a genuine billing verdict — a 402, or the classifier's ``billing`` reason on a 403 spending limit — is named here; a plain 429/quota bench keeps the existing cooldown wording (with its reset time, #56810), which the caller falls back to when this returns ``None``. *pool* is an already-loaded ``CredentialPool`` (preferred — it carries the live in-memory exhaustion state); otherwise the persisted rows are read (no seeding, no writes, mirroring ``pool_cooldown_message``). ``None`` when the pool is empty, a credential is usable, no entry is currently benched, or none carries a billing verdict. )FAILURE_REASON_BILLINGr<STATUS_EXHAUSTEDr=r>Nr?rKrAlast_error_codeifailure_reasonlast_error_messagerCrDrEz for model ''z (last error z: )rFz is out of usable credentials: z exhaustedzv. Add credits or update billing with that provider, then retry, or switch to a different provider with `hermes model`.)rHrlr<rmr=r>r'r(r)listrQr%r@r,rIrJgetattrrLrMr2r5)r9rhrirlr<rmr=r>rQr@rRrSrTbenchedbillingpickr detailrXscope code_texts&$$ rpool_billing_messager|jsR2G   Y ' '  4<<>*G <!5[ AZ A1ZPQSWEXB'11+A A Z ( Qw!'!]D"A["PAAwD Q  ))+Ca 1mT *.> > aTa @ E EA L 4   7|s4y a 1' .# 5 1& -1G G 7   1:D 4*D 1D 3T:@@b A G G IF(+D Q $d3t9+M]<^E',l5' #"ELP-vvdVm2%FaHVXI [M5')Hz +7 87Z ( ' ' RsS/H6"H1?H1H6"I ;I &I?II&I &I8I1H66 I c]tRt^tRtRtR#)ProviderNotConfiguredErroraAgent init found no usable inference provider: nothing is configured, or the explicitly configured one has no credentials. A distinct type because the remedy is setup, not a retry: clients route it to their provider setup / onboarding flow. The wording of the two messages has changed more than once, so a client that recognises this failure by matching their text silently stops routing (#119232's sibling); the type and the gateway's ``code`` survive rewording. rNr rrrr~r~srr~c0V^8dQhR\R\/#r8)r2)rs"rrrsMMcMcMrc\V4pV'dV#Rp\P!\4;_uu_4^RIHpVP V4pRRR4\\VRR4;'gR4pRRre^RI H pW9dRRreMsV'dR V^, R 2pM]Vf&R VP4PR R 4 R 2pM4\VP4PR4'd RRV R2reMRpRpRV RV R2V'dV RV 2,#VP!4,# +'giL;i)u.The "Provider 'X' is set in config.yaml but …" error for an explicit provider with no credentials. The remedy comes from the registry, never from the provider id: ``f"{id.upper()}_API_KEY"`` invents names nothing reads (alibaba → ALIBABA_API_KEY instead of DASHSCOPE_API_KEY, and the unsettable MINIMAX-OAUTH_API_KEY for OAuth ids, #114405 / #78996). OAuth providers have no key env var at all, so they are pointed at the sign-in command instead. A pool whose every credential is cooling down is not "missing" — that case names the cooldown (#56810). N)PROVIDER_REGISTRYapi_key_env_varszno API key was foundrq)LLAMACPP_ALIASESz$no local llama.cpp server is runningu3Start it in Settings → Providers → Local modelszSet the z environment variable-_z_API_KEY environment variableoauthzno credentials were foundzRun `hermes auth add z ` to sign inz3switch to a different provider with `hermes model`.rFrGz. z, or r)rYr'r(r)r%rr*tupleru!hermes_cli.local_runtime.endpointrupperreplacer2 auth_type startswith capitalize) r9cooldownpconfigrenv_varsproblemremedyrswitchs & r$missing_provider_credentials_messagersC%[1HG   Y ' '5#'' 4 (WW&8$?EE2FH,bVB&@Bw HQK=(=> K--/77SABB_` W    * *7 3 359N{m[g7h- BF %A'" M+1&vh' LM7=7H7H7J LM# ( 's D55 E c0V^8dQhR\R\/#r)rbool)rs"rrrs  - D rc\VRR4'dR#^RIHp\P!\ 4;_uu_4\ V!R44uuRRR4# +'giR#;i)uTrue when a Nous credential exists that failed — a coded error (``invalid_grant``, a quarantine marker, ``refresh_failed``) or persisted Nous auth state. The uncoded "not logged into Nous Portal" with no stored state is the normal condition for users who never chose Nous; the auto-route walk hits it on every discovery pass and must not warn (the ladder already logs its own summary). r NT)rrF)rur%rr'r(r)r)rrs& r_nous_credential_presentrsJ sFD!!7   Y ' '+F34 ( ' ' ' s A A+ c0V^8dQhR\R\/#r)rr2)rs"rrrs #rcl^RIHp\V4p\V\4'd V!V4M \ V4pVP 4;'g\V4Pp\VRR4pV'd\ V4V9d V RV R2pRV 2p\;_uu_4Vs V\9p\PV4RRR4X'dI\V4'd\P M\P"p\$P'VRV4V# +'giLb;i)zRemember *exc* as the latest Nous credential failure. Logged once per distinct message: WARNING when a real credential failed, DEBUG when Hermes was simply never logged into Nous. )format_auth_errorr Nz (code: rsz-Nous Portal runtime credentials unavailable: z%Auxiliary Nous client unavailable: %s)r%rr.r,r)r2r5typer ru_lock_last_nous_detail_warned_nous_detailsaddrloggingWARNINGDEBUGloggerlog)rrrr ry first_timelevels& rrecord_nous_credential_failurers 2 !# &C(23 (B(B$CGmmo33c!3!3G 3 %D D (IXdV1-rs  %   8 $\\ #''!$&./ 7F ! !G G GTMD 4! !r