+ jHj6a0t$Rt^RIHt^RIHt^RIt^RIt^RIt^RI t ^RI t ^RI t ^RI t ^RI t ^RIt^RIHtHt^RIHtHt^RIHt^RIHtHtHt^RIHt^R IHtHtHtH t H!t!H"t"H#t#H$t$^R I%H&t&^R I'H(t(H)t)H*t*^R I+H,t,^R I-H.t.H/t/H0t0H1t1^RI2H3t3H4t4H5t5H6t6H7t7H8t8^RI9H:t:H;t;^RIt>H?t?H@t@HAtAHBtBHCtCHDtDHEtEHFtFHGtGHHtHHItIHJtJ^RIKHLtLHMtMHNtNHOtOHPtPHQtQ^RIRHStSHTtTHUtUHVtVHWtWHXtXHYtYHZtZH[t[H\t\H]t]H^t^H_t_H`t`HataHbtbHctcHdtdHeteHftfHgtgHhthHitiHjtjHktkHltlHmtmHntnHotoHptpHqtqHrtrHstsHtttHutuHvtvHwtwHxtxHytyHztz^RI{H|t|H}t}H~t~HtHtHtHtHtHtHtHtHtHt^RIHtHtHtHtHtHtHtHtHtHtHtHtHtHt^RIHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHt^RIHt^RIHt^RIHtHtHtHtHtHtHt^RIHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHt]EP!]4t^RIt^RItRRltRRlt]!RR44tERR!R"llt.]!R#R$R%]]]]R&7N]!R'R(R)]R*7NERN]!R+R,R)]R*7N]!R-R.R)]R*7NERNR0R1]ERR23N]!R3R4R5]R6R77NERNERNERNERNR3NERNERNRARB]ERRC3NERN]!RDRERF]]]]RGRHRI]RJ]/RK7NERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNRYRZ]ER R[3NER NER NER N5tR_]R`&Ra]4Uu/uFqEPVbK uptRb]Rc&]!]4t^RdIHtHtHtHtHt^ReIHtHtHt]!4RfRglt0ER mtERtRhRiltRj^/RkRlllEtRmER/EtRn]Ro&RpRqlEtRrRslEtRtRulEtRvRwlEtRxRylEtRzR{lEtR|R}lEtR~RRR/Et ]!E] 40ERm,Et RRlEt RRlEt RRlEt RRlEtRRlEt/EtR]R&] EP"!4EtRRlEtRRlEtRRlEtRRlEtRRlEt]!R]EP0]EP2E]!]RR4344EtRRlEtRRlEtRRlEtRRlEt]RRl4Et ]]3RR/RRlll4Et!RRlEt"ERRRllEt#RR/RRllEt$ERRRllEt%RRlEt&RRlEt'RRlEt(RRlEt)]]3RRll4Et*RR/RRllEt+RRlEt,RRlEt-RR/RRllEt.RRlEt/RRlEt0RRlEt1RRlEt2RRlEt3ERRRllEt4EREt5EREt6RRlEt7RRlEt8RRRR/RRllEt9RRlEt:RRlEt;RRRRRR/RRllEtRRlEt?RRlEt@RRlEtARRlEtBRRlEtCRRlEtDRRlEtERRlEtFRRlEtG]!RM04EtH]!0ERm4EtIEREtJRRlEtKRRlEtLRRlEtMRRlEtNE]DR3E]FR3E]LR3E]GR3E]NR33EtOER]ER&ERERlEtPERERERllEtQERERlEtRERER lEtSER ER lEtT/ER R9bER R9bERR9bERR9bERR8bERR8bERR8bERRPbERRPbERRPbR+R+bERR+bERR+bERR+bERR:bERR:bERR:b/ERR;bERR;bERRRUbER?RUbER@RUbERARVbERBRVbERCRWbERDRWbERERWbERFRWbERGRXbERHRXbERIR\bERJR\bERKR\bERLR\bERMRSbC/ERNRSbERORTbERPRTbERQRTbR/R/bERRR/bERSR/bERTR'bERUR'bERVERWbERXERWbERYRYbERZERWbER[ERWbER\ERWbER]ERWbCEtUER^]ER_&ER`ERalEtVERbERclEtWERdERelEtXERfR/ERgERhllEtYERiERjlEtZ]!R0R/04Et[ERkERllEt\ERERmRERnRERfR/ERoERplllEt]ERqERrlEt^ERsERtlEt_ERuERvlEt`ERwERxlEtaERyR/ERzER{llEtbEREtcER|ER}lEtdER~ERlEteERERlEtf]!0ERm4EtgER]ER&] EP"!4Eth/EtiER]ER&EREtjERERERRERRER]/ERERllEtkERERlEtlEREtmREsnER]ER&REsoER]ER&ERERlEtpERERlEtqERERlEtr]!RER7!ERER44Ets]!0ERm4Ett]!0ERm4EtuR#E]s!R#ERERE]tE]u,RER7R'E]s!R'ERERE]tERER0,RER7R+E]s!R+ERER]!ERER04RER7R-E]s!R-ERER4RDE]s!RDERER4/EtvER]ER&ERERlEtw]!E]wR#ER7Etx]!E]wR+ER7Ety]!E]wR'ER7EtzERERlEt{ERERlEt|ERERlEt}ERERlEt~ERERlEtERERlEtERERlEtERERlEtERERlEtERERlEtERERERllEt/E]vEP 4UUu/uFwrWEPbK uppCR^ER/CEtER^]ER&R5ERR ERR]ERR%ERR)ER/EtER^]ER&ERERlEtERERlEtERERlEtR:]6R;]6R9]7R0E]R/ERRAER/EtER]ER&ERERlEtERERlEtERERR/ERERlllEtERERlEtERERlEtERERlEtERERlEtERERlEtERERlEtERERlEtR# ]dRtE Li;i ]dRtE L"i;iuupiuuppi(aMulti-provider authentication system for Hermes Agent. - ``ProviderConfig`` / ``PROVIDER_REGISTRY`` describe every known inference provider. - The auth store (``~/.hermes/auth.json``) holds per-provider state, the credential pool and suppression markers; ``_auth_store_lock`` / ``_load_auth_store`` / ``_save_auth_store`` are the only I/O primitives (cross-process flock, atomic 0o600 writes). - ``resolve_provider()`` picks the active provider via the documented priority chain. - ``OAUTH_PROVIDER_FLOWS`` maps each OAuth provider to its resolver/status builder; the flows live in ``auth_nous``/``auth_codex``/``auth_xai``/``auth_qwen``/``auth_minimax``/``auth_openrouter`` and are re-imported here so ``hermes_cli.auth.`` stays the public/patchable surface.) annotations) install_hintN) ExitStackcontextmanager) dataclassfield)partial)datetimetimezoneUTC)Path)AnyCallableDict FrozenSetIterableListOptionalTuple)urlparse)OPENROUTER_BASE_URLhermes_home_keysecure_parent_dir)$sanitize_borrowed_credential_payload)atomic_json_write env_floatfile_signatureis_truthy_value)KIMI_CODE_BASE_URL ZAI_ENDPOINTS$_normalize_lmstudio_runtime_base_url_resolve_kimi_base_url_resolve_zai_base_urldetect_zai_endpoint)_prompt_model_selection_save_model_choice)_can_open_graphical_browser_default_verify_is_remote_session!_nous_device_auth_timeout_message!_offer_existing_oauth_credentials_poll_device_token_generic_poll_for_token_print_device_code_instructions_print_login_success_print_loopback_ssh_hint_prompt_yes_no_request_device_code_resolve_verify_ssh_user_at_host)!SINGLE_USE_REFRESH_POOL_PROVIDERS_oauth_heal_clean_marks_oauth_heal_noticesconsume_oauth_heal_notices#heal_forked_single_use_oauth_grants$strip_cloned_single_use_oauth_grants)(NOUS_SESSION_TERMINALNOUS_SESSION_UNKNOWNNOUS_SESSION_VALID_ALLOWED_NOUS_INFERENCE_HOSTS_agent_key_is_usable_apply_nous_refreshed_tokens!_assert_nous_inference_jwt_usable_compute_nous_auth_status#_format_nous_entitlement_auth_error_healed_nous_inference_url _login_nous_merge_shared_nous_oauth_state_migrate_stale_nous_portal_url_nous_device_code_login_nous_inference_env_override_nous_invoke_jwt_is_usable_nous_invoke_jwt_status_nous_portal_base_url_nous_portal_env_override_nous_shared_store_lock_nous_shared_store_path_pool_first_oauth_status_quarantine_nous_oauth_state_quarantine_nous_pool_entries_read_shared_nous_state_refresh_access_token_refresh_nous_or_quarantine_select_nous_invoke_jwt_sync_nous_pool_from_auth_store_token_fingerprint_try_import_shared_nous_state)_validate_nous_inference_url_from_network_write_shared_nous_statefetch_nous_modelsget_nous_auth_status_localget_nous_session_validitypersist_nous_credentialsrefresh_nous_oauth_from_state resolve_nous_runtime_credentialsstep_up_nous_billing_scope) _MINIMAX_OAUTH_ERROR_BODY_LIMIT_login_minimax_oauth_minimax_oauth_login_minimax_pkce_pair_minimax_poll_token_minimax_post_form_minimax_request_user_code"_minimax_resolve_token_expiry_unix_minimax_response_error_text_minimax_save_auth_state_refresh_minimax_oauth_state"build_minimax_oauth_token_provider)resolve_minimax_oauth_runtime_credentials)_login_xai_oauth_read_xai_oauth_tokens_refresh_xai_oauth_tokens_save_xai_oauth_tokens'_write_through_xai_oauth_to_global_root_xai_access_token_is_expiring_xai_oauth_device_code_login_xai_oauth_discovery_xai_oauth_poll_device_token_xai_oauth_request_device_code#_xai_proactive_refresh_skew_seconds _xai_validate_inference_base_urlrefresh_xai_oauth_pure%resolve_xai_oauth_runtime_credentials)_codex_access_token_is_expiring_codex_device_code_login_codex_http_client_codex_pool_rate_limit_status_codex_quota_probe_cache_codex_usage_probe_url_import_codex_cli_tokens_is_codex_rate_limit_shaped_login_openai_codex_probe_codex_quota_restored_read_codex_tokens_refresh_codex_auth_tokens"_refresh_expired_codex_probe_token_save_codex_tokens clear_codex_pool_quota_cooldownsrefresh_codex_oauth_pure!resolve_codex_runtime_credentials)_openrouter_pkce_login)note_store_write)_qwen_access_token_is_expiring_qwen_cli_auth_path_read_qwen_cli_tokens_refresh_qwen_cli_tokens_save_qwen_cli_tokensget_qwen_auth_status resolve_qwen_runtime_credentials)*_decode_jwt_claimsAUTH_STORE_VERSIONAUTH_LOCK_TIMEOUT_SECONDSDEFAULT_NOUS_PORTAL_URLDEFAULT_NOUS_INFERENCE_URLDEFAULT_NOUS_CLIENT_IDNOUS_BILLING_MANAGE_SCOPEDEFAULT_NOUS_SCOPENOUS_DEVICE_CODE_SOURCENOUS_AUTH_PATH_INVOKE_JWT!ACCESS_TOKEN_REFRESH_SKEW_SECONDSNOUS_INVOKE_JWT_MIN_TTL_SECONDSDEFAULT_CODEX_BASE_URLDEFAULT_XAI_OAUTH_BASE_URLMINIMAX_OAUTH_CLIENT_IDMINIMAX_OAUTH_SCOPEMINIMAX_OAUTH_GLOBAL_BASEMINIMAX_OAUTH_CN_BASEMINIMAX_OAUTH_GLOBAL_INFERENCEMINIMAX_OAUTH_CN_INFERENCE"MINIMAX_OAUTH_REFRESH_SKEW_SECONDSDEFAULT_QWEN_BASE_URLDEFAULT_GITHUB_MODELS_BASE_URLDEFAULT_COPILOT_ACP_BASE_URLDEFAULT_OLLAMA_CLOUD_BASE_URLDEFAULT_ACTUAL_BASE_URLDEFAULT_ACTUAL_LOCAL_BASE_URLSTEPFUN_STEP_PLAN_INTL_BASE_URLSTEPFUN_STEP_PLAN_CN_BASE_URLCODEX_OAUTH_CLIENT_IDCODEX_OAUTH_TOKEN_URL'CODEX_ACCESS_TOKEN_REFRESH_SKEW_SECONDSXAI_OAUTH_CLIENT_IDXAI_OAUTH_SCOPE%XAI_ACCESS_TOKEN_REFRESH_SKEW_SECONDS&QWEN_ACCESS_TOKEN_REFRESH_SKEW_SECONDSLMSTUDIO_NOAUTH_PLACEHOLDERACTUAL_LOCAL_NOAUTH_PLACEHOLDERCODEX_RATE_LIMITED_CODE AuthError _nous_errhttpxc V^8dQhRRRR/#)base_urlstrreturnbool)formats"4/home/ubuntu/.hermes/hermes-agent/hermes_cli/auth.py __annotate__rus@@s@t@c\T;'gR4P;'gRP4PR4pTR9# \dR#i;i)z5Return True for Actual's loopback local API endpoint..F> localhost::10.0.0.0 127.0.0.1)rhostnamelowerrstrip Exception)rhosts& ris_actual_local_base_urlrus[R(1177R>>@GGL ? ?? s A A A AAc V^8dQhRRRR/#)rrrrr)rs"rrr~src\T;'gR4P4PR4pV'g\#\ V4pVP ;'gRP 4PR4pVPPR4pTR9d"TR8Xg\T4'd TR,#T# \dTu#i;i)zReturn Actual's OpenAI-compatible base URL (hosted api.actual.inc or the loopback local server; both expose a /v1 surface for the selected OpenAI-compatible transport).r/rzapi.actual.incz/v1>rr) rstriprrrrrpathrr)rurlparsedrrs& rnormalize_actual_base_urlr~s hnn"  # # % , ,S 1C &&#%%2,,.55c:{{!!#& yd&66:RSV:W:WU{ J  sC ;C CCc]tRt^t$RtR]R&R]R&R]R&RtR]R&RtR]R&RtR]R &Rt R]R &] !] R 7t R ]R &Rt R]R&RtR]R&RtR#)ProviderConfigz%Describes a known inference provider.ridname auth_typerportal_base_urlinference_base_url client_idscope)default_factorydict[str, Any]extratupleapi_key_env_varsbase_url_env_varrN)__name__ __module__ __qualname____firstlineno____doc____annotations__rrrrrdictrrr__static_attributes__rrrrrsa/ G INOS  IsE3O!$7E>7 e crrapi_keyc4V^8dQhRRRRRRRRRRRRR R /#) rrrrrrrrrrrr)rs"rrrsMNN NN,/NCHNN+.N?MNrc \WWRW4R7#)z@Compact constructor for the common env-var-keyed provider shape.)rrrrrr)r)rrrrrrs&&&&&&r_api_key_providerrs  I) NNrnousz Nous Portaloauth_device_code)rrrr openai-codexz OpenAI Codexoauth_external)r xai-oauthz%xAI Grok OAuth (SuperGrok / Premium+)z qwen-oauthz Qwen OAuthlmstudiocopilotzGitHub CopilotCOPILOT_API_BASE_URL copilot-acpzGitHub Copilot ACPexternal_processCOPILOT_ACP_BASE_URL)rrgeminizai kimi-codingkimi-coding-cnstepfunzStepFun Step PlanSTEPFUN_BASE_URLarceegmiactualzActual ComputerACTUAL_BASE_URL minimax-oauthuMiniMax (OAuth · minimax.io) oauth_minimaxregionglobalcn_portal_base_urlcn_inference_base_url)rrrrr anthropicCLAUDE_CODE_OAUTH_TOKENalibaba-coding-plan minimax-cnxai ai-gateway opencode-zen opencode-gokilocode huggingfacexiaomitencent-tokenhubtencent-tokenplanz ollama-cloudz Ollama CloudOLLAMA_BASE_URLbedrockaws_sdk azure-foundryztuple[Any, ...]_REGISTRY_ROWSc#d"TF&p\V\4'dTM\V!xK( R#5iN) isinstancerr).0rs& r r.s+l]kXY:a88a>OQR>SS]ks.0zdict[str, ProviderConfig]PROVIDER_REGISTRY)atomic_config_replaceget_hermes_homeget_config_pathread_raw_config$require_readable_config_before_write)get_plugin_oauth_auth_statusregistry_lookupsync_plugin_provider_registrycV^8dQhRR/#rrrr)rs"rrr s d d3 drcxa^RIHo\R,Pp\ RV3RlV44R4#)uuFirst usable Anthropic credential (``.env`` preferred over a stale shell export), or ``""``. Order mirrors ``PROVIDER_REGISTRY["anthropic"].api_key_env_vars``. Checks both the ``.env`` file and the process environment, preferring ``~/.hermes/.env`` so a deliberate key rotation isn't shadowed by a stale shell export (matches the api-key resolution path — see #20591). get_env_value_prefer_dotenvrc38"TFq'gK VxK R#5ir*rr,vs& rr.$get_anthropic_key..s^Xq\]X  c3H<"TFpS!V4;'gRxK R#5irNr)r,varr<s& rr.r@s"Xx8=CCCxs" "r)hermes_cli.configr<r/rnext)env_varsr<s @rget_anthropic_keyrH s2> ->>H ^XxX^`b ccrc V^8dQhRRRR/#)rvaluerrrr)rs"rrr&s > > > >rcjVP4pVPR4'dVPR4'dR#\FqpVPV4'gKV\ V4RpV'gK4\ ;QJdRV4F 'dK RM RM !RV44'gKpR# VP RR4P R R4P R R4p\V4;'d5\ ;QJdR V4F 'dK R# R#!R V44#) zETrue for the placeholder shapes shipped in .env.example and the docs.your__hereTNc3*"TF qR8HxK R#5ixNrr,cs& rr.(_is_placeholder_shape...s3dHdF r-_c3*"TF qR8HxK R#5irOrrQs& rr.rS1s!=Hqs(HrT)r startswithendswith_PLACEHOLDER_KEY_PREFIXESlenallreplacer)rJloweredprefixtailstrippeds& r_is_placeholder_shaperc&skkmG'""w'7'7'@'@+   f % %3v;<(Dt3d33d333 , sB'//R8@@bIH > = =cc!=H!=cc=c=c!=H!===r min_lengthc$V^8dQhRRRRRR/#)rrJr rdintrrr)rs"rrr4s!44S44T4rc\V\4'gR#VP4p\V4V8;'d0VP 4\ 9;'d\ V4'*#)zIReturn True when a configured secret looks usable, not empty/placeholder.F)r+rrr\r_PLACEHOLDER_SECRET_VALUESrc)rJrdcleaneds&$ rhas_usable_secretrj4s\ eS ! !kkmG LJ & 3 3 'AA 3 3)'224r openrouterzdict[str, tuple]KNOWN_PROVIDER_KEY_PREFIXESc$V^8dQhRRRRRR/#)r provider_idrvalrrr)rs"rrrGs&LLSLsLtLrcLVP\PVR44#)zqTrue when *val* starts with one of *provider_id*'s declared key prefixes (False when the provider declares none).r)rYrlget)rnros&&r_matches_key_prefixrrGs! >>599+rJ KKrc V^8dQhRRRR/#rrJr rrr)rs"rrrMsGGSGTGrc\\R\T;'gR4P44#)zTrue when *value* carries an OpenRouter key prefix. OPENAI_API_KEY is a legacy home for an OpenRouter key, so only a value shaped like one may be read as an OpenRouter credential: a real OpenAI key must never be auto-routed to, or sent to, openrouter.ai.rkr)rrrrrJs&rlooks_like_openrouter_keyrwMs% |S"-=-C-C-E FFrc(V^8dQhRRRRRRRR/#)rrnrrJr sourcer Optional[str]r)rs"rrrTs(S#-rc\T;'gR4P4p\V4'gR#\P V4pV'd:\ W4'g)\ PRW RPV44R#V#)z*value* stripped when it is a usable, prefix-valid secret; None (after warning on a provable prefix mismatch, so it never shadows a later credential source) otherwise. Providers without a declared prefix are fail-open.rNzIgnoring %s for provider %r: value does not match the expected key prefix (%s). Falling back to the next credential source. Fix or remove the malformed key to silence this warning.z or ) rrrjrlrqrrloggerwarningjoin)rnrJryroprefixess&&& r_usable_declared_secretrTsu ekkr  "C S ! !*..{;H+K== @ X!6  8  Jrc V^8dQhRRRR/#rrnrrr)rs"rrrfsWWcWcWrc^RIHpV!4;'g/PR4p\ T\ 4'gR#\ TPR4;'gR4P4P4T8wdR#\ TPR4;'gTPR4;'gR4P4# \dR#i;i)u1``model.key_env`` when config.yaml's main model targets *provider_id*, else ``""``. The Desktop settings UI saves registry-provider keys as a credential pointer (``model.key_env`` → ``$HERMES_HOME/.env``) instead of the registry's canonical env var, so credential resolution must consult it (#106336).  load_configmodelrproviderkey_env api_key_env) rErrqrr+rrrr)rnr model_cfgs& r_model_level_key_envrfs1 ]((b--g6  i & & 9== $ * *+11399;{J y}}Y'MM9==+GMM2 N T T VV sCC C! C!c$V^8dQhRRRRRR/#)rrnrpconfigrrtuple[str, str]r)rs"rrrys";;#;;Sb;rcaVR8Xd+^RIHpHpV!4wrEV'dV!V4wrgWe3#R#^RIHp \V4p V 'd\W !V 4V 4p V 'dW3#VPF"p \W !V 4V 4p V 'gKW3u# RV 2p ^RI H pV!V4pV'dVP4'dVP4pVeV.M.pVP!4F\oSfK \";QJdV3R lV4F 'dK R M R M!V3R lV44'gKKVP%S4K^ VF?p\'VR R4;'g\'VR R4p\VVV 4p V 'gK<W3u# R# \d"p\P RT4Rp?R#Rp?i\ dR#i;i \ dLi;i \ dR#i;i)zDResolve an API-key provider's token and indicate where it came from.rresolve_copilot_tokenget_copilot_api_tokenz#Copilot token validation failed: %sNrr;zcredential_pool: load_poolc3,<"TF pSVJxK R#5ir*r)r,rRrs& rr.3_resolve_api_key_provider_secret..s0TAasFT access_tokenruntime_api_key)rr)hermes_cli.copilot_authrr ValueErrorr|r}rrEr<rrragent.credential_poolrhas_credentialspeekentriesr]appendgetattr)rnrrrtokenry api_token _base_urlexcr<rroenv_var pool_sourcerpoolentry candidateskeyrs&& @r _resolve_api_key_provider_secretrysi  \13ME' #;/G%k3Nw3WY`a < ++%k3Nw3WY`a 3<  ,%[M2K 3% D((**IIKE$)$5%2J !\\^E(SS0T0TSSS0T0T-T-T"))%0, $e^R8aaGEK\^`>V #6u= =/33EJJ? N zz..788 u:rc V^8dQhRRRR/#rtr)rs"rrrs::::rcd\V\4;'d\VP44#r*)r+rrrrvs&r _nonempty_strrs" eS ! 9 9d5;;=&99rcV^8dQhRR/#rrr r)rs"rrrs   rc\4R, p\PPR4'dC\ V\ P !4R, R, 4'd\RV R24hV#) auth.jsonPYTEST_CURRENT_TEST.hermesz8Refusing to touch real user auth store during test run: zq. Set HERMES_HOME to a tmp_path in your test fixture, or run via scripts/run_tests.sh for hermetic CI-parity env.)r1osenvironrq _same_pathr home RuntimeErrorrs r_auth_file_pathrsl  { *D ,--4y!8;!FGGFtfMC CD D KrcV^8dQhRR/#)rrOptional[Path]r)rs"rrrs ] ] ]rc^RIHpV!4p\\ 4T4'dR#TR, # \dR#i;i)zGlobal-root auth.json in profile mode; None when profile and global root are the same dir. Read-only fallback path, so no pytest seat belt here (it lives on ``_auth_file_path()``).)get_default_hermes_rootNr)rrrrr1)r global_roots r_global_auth_file_pathrsH<-/ o/==4\;Q\C\\ s 4 AAcV^8dQhRR/#rrrr)rs"rrrsrc\4pVeVP4'gRs/#\VP RR74\ VP 443p\pVeVeVR,V8Xd V^,#\PPR4'd\PPR4'd\\PR,4R, R, p\PP\PPV44\PP\PPV448XdRs/#\V4pTe.TOTN5sT# \dRpELGi;i \dL:i;i \dRs/u#i;i) uLoad the global-root auth store (read-only fallback, mtime-memoised); ``{}`` when absent or unreadable — a malformed global store must never break profile reads.NFstrict:NrNrHOMErr)rexists_global_auth_store_cacherresolverstatrrrrqr rnormcaseabspath_load_auth_store) global_path cache_keycached real_rootstores r_load_global_auth_storers)*K+"4"4"6"6#'    ##5#1 2N;CSCSCU4VFX &F!3r i8Oay zz~~+,,1G1GF+,y8;F  ww <=AQAQRTRYRYRaRabkRlAmm+/( n  -#6Y#6#6 L)      #'  s64FF)= F: F&%F&) F76F7:G  G zdict[str, threading.local]_auth_target_lock_holdersc$V^8dQhRRRRRR/#rleftr rightrrr)rs"rrr,s!T$4rcxVPRR7VPRR78H# \dY8Hu#i;i)Fr)rrrrs&&rrr,s?||5|)U]]%]-HHH }s $'99c$V^8dQhRRRRRR/#rr)rs"rrr3s!  d 4 D rcp\W4'dR#VPV4# \dR#i;i)a True when two auth paths name ONE store rather than two copies. ``_same_path`` resolves symlinks and ``..``; ``samefile`` adds hardlinks and bind-mounts (same inode under two resolved names). Used by the forked-grant heal: a shared store has no "other side" to consolidate. See #101356. TF)rsamefileOSErrorrs&&r_is_same_auth_storer3s8$}}U## s & 55c V^8dQhRRRR/#)rrr rrr)rs"rrrCsrcr\VPRR74# \d\T4u#i;i)zWCanonical string for *path* (resolved when possible) used as a cache / lock-holder key.Fr)rrrrs&r _resolved_keyrCs64<stackrdeadlinerhints &&&& r _file_lockrTsMvw"Q&     LLA L 4$7    2 vy//11Y^^5E5M5MQR5R((w(?++INN664t^eN,fgI~~'#c?*CCH % D1  $&y1 FL$.y9 E2%I  LLA L 1(/B %.s33~~'830;*4o->b+GeeUdeeJJt$$ %, FL$.y9 E2 %I s,J8FA J8=J$J$2J$F2%!J$5J$= G  J$I*%J$< IJ$ J8F//J82GJ$GJ$ IA+I J$IJ$ I'$J$&I''J$*J! JJ! J J!J J!!J$$ J5 / J8rc V^8dQhRRRR/#)rr<r=rrr)rs"rrrs   HV rc#"VeTM \4pVPR4p\V\V4VRV R24;_uu_4RxRRR4R# +'giR#;i5i)a]Cross-process advisory lock for one auth.json read/write transaction. ``target_path`` is required for profile-to-global write-throughs: each path has its own reentrancy tracker and kernel lock. Lock ordering invariant: ``_auth_store_lock`` FIRST (outer), ``_nous_shared_store_lock`` SECOND (inner), else deadlock against a concurrent shared import.Nz.lockz'Timed out waiting for auth store lock ())r with_suffixrTr)r<r auth_pathrs&$ r_auth_store_lockrZsk +6 O @ @  @ @ @ @sAA*A A* A' ! A*cV^8dQhRR/#rr)rs"rrrs<<>!E!Ei.8E8PVW]34VX B#%B{I!Y6B B<@B B  O   4   &  #!,,_=  ( LL 1I (I LLUWc"&  ( (  M +4 ':\    !""!#sG&F,I4I5H<G H< %HH<H.H<6I<I fsync_dirFc ,V^8dQhRRRRRRRRRR /#) rtargetr datar rpr dump_kwargsrrr)rs"rrrs8TTtT3TdT[^TcgTrc l^RIHpV!VP4\V4\ W3RRRV/VBR#)z0600 credential JSON under a 0700 parent (``secure_parent_dir`` refuses ``/``, top-level dirs and the install tree). ``atomic_json_write`` creates the temp file 0600 before any byte lands.)mkdir_under_hermes_homemodeirpN)rrvrErr)rrrsrprtrvs&&$, r_save_private_jsonrxs29FMM*ffSS)S{Src$V^8dQhRRRRRR/#)r auth_storerrrrr r)rs"rrrs"   n X\ rcVeTM \4p\VR&\P!\4P 4VR&\ W RR7VeRsV#)zAtomically persist *auth_store* (0o600, parent tightened to 0o700) to the active store, or to an explicit *target_path* (e.g. the global-root write-through for rotating xAI OAuth grants).Nr] updated_atT)rp)rrr nowr isoformatrxr)rzrras&& r_save_auth_storersW +6 O shared lock order. ``timeout_seconds`` applies to BOTH locks: a transaction that spans a network call must let waiters outlive that call.Nr)rZrrrrr)rnr<rzr source_paths&& r_provider_state_transactionrOs / * *%' =jV  *[/:K"L"L[0 0  + * o G G01A+1NP[\^ii iH + * H G + * *s@C=B1 CB11B B1 C B. )B11 C < C set_activeTc ,V^8dQhRRRRRRRRRR /#) rrzrrnrrrrrrr)rs"rrras544n434~4nr4C4rcX\WV4V\VR4V&V'dWR&R#R#)r^rgN)rr)rzrnrrs&&&$r_store_provider_stateras.Ze4;@N:{+K8(3$%rc(V^8dQhRRRRRRRR/#)rrzrrnrrrrr)rs"rrrhs/KK^K#KnKaeKrc"\WVRR7R#)zMWrite *state* under ``providers`` and make *provider_id* the active provider.TrN)r)rzrnrs&&&r_save_provider_staterhs*5TJrc$V^8dQhRRRRRR/#)rrnrrrrr r)rs"rrrms!,,S,,D,rc\4;_uu_4\4p\W V4\V4uuRRR4# +'giR#;i)zTLock, load, write *state* as the active provider, save. Returns the auth store path.N)rZrrr)rnrrzs&& r_save_active_provider_staterms4   %' Ze< +    s !? A c ,V^8dQhRRRRRRRRR R/#) rrnrrrrr rrrr)rs"rrrus;EEE+E:>EOSE Erc \VR7;_uu_4\V4p\W@\V4VR7\ WBR7uuRRR4# +'giR#;i)zFMerge one provider into a specific auth store under that store's lock.rrN)rZrrrr)rnrrrrzs&&&$ r _persist_provider_state_to_storerus@ k 2 2%k2 jtE{zZ D 3 2 2 2s .A A c ,V^8dQhRRRRRRRRRR /#) rrzrrnrrrrrrr)rs"rrrs; \ \ \-0 \9G \Vd \  \rcVe\V\44'd\WVRR7\V4R#\ WVRR7R#)a4Persist provider state back to the auth store it was read from. A token refresh rewrites credentials, not the user's choice of provider: ``active_provider`` is left as it is (a Nous free-tier identity refreshed for a connector call must not become the inference provider of an install that has its own key).NFr)rrrrr)rzrnrrs&&&&r_save_provider_state_to_sourcers:jo6GHHjuO$(Z[rc V^8dQhRRRR/#)rrnrrrr)rs"rrrs))s)t)rc\4;_uu_4\4pVPR4;'gRP4'gWR&\ V4RRR4R# +'giR#;i)zSet ``active_provider`` only when none is set yet: the first ``hermes auth add`` credential must make its provider active (else setup reports "No inference provider configured"); later adds leave the user's choice untouched.rgrN)rZrrqrr)rnrzs& rmark_provider_active_if_unsetrsV   %' 0177R>>@@,7( ) Z (    s9A& A&& A7 c V^8dQhRRRR/#rrnrrrr)rs"rrrs4444rclT;'gRP4P4p\V4RJ#rC)rr_registry_lookuprn normalizeds& ris_known_auth_providerrs1##**,224J J 't 33rc V^8dQhRRRR/#rr)rs"rrrsrcT;'gRP4P4pV\9d\V,P#V#r)rrr/rrs& rget_auth_provider_display_namersA##**,224J&& ,111 rc V^8dQhRRRR/#rr)rs"rrrs  c d rcT;'gRP4P4pV'gR#VR9gVPR4'dR#\V4R# \dR#i;i)zWhether runtime resolution recognizes a provider identity (a capability check, not a credential check): ``resolve_provider`` normalization plus the special runtime identities outside the registry.rFcustom:T>moaautocustomrk)rrrYresolve_providerrrs& ris_runtime_provider_routablersl##**,224J << @U@UV_@`@`$  s A!! A0/A0c V^8dQhRRRR/#rrnrzrrr)rs"rrrsLLmL~Lrc\4PR4p\V\4'dTM/p\ 4PR4p\V\4'dTM/pVf\V4pVP 4FcwrEVPV4p\V\ 4'd V'gK6\V\ 4'd V'dKV\ V4W4&Ke V#VPV4p\V\ 4'dV'd \ V4#VPV4p\V\ 4'd \ V4#.#)zReturn the persisted credential pool, or one provider slice. In profile mode the global-root ``auth.json`` is a read-only fallback applied per provider ONLY when the profile has zero entries for it (``hermes auth add`` in the profile shadows global).rd)rrqr+rritemslist) rnr global_poolmergedgp_key gp_entriesexistingprovider_entriesglobal_entriess & rread_credential_poolrs   ! !"3 4DdD))4rD)+//0ABK!+K!>!>+BKd"-"3"3"5 Fzz&)Hz400Zx..88!%j!1 #6  xx ,"D)).>$%% __[1N#-nd#C#C4 KKrc V^8dQhRRRR/#)rrowr rztuple[Any, Any]r)rs"rrrs====rcv\V\4'gR#VPR4VPR43#)Nr refresh_tokenrr+rrq)rs&r_credential_token_pairrs2 c4  77> "CGGO$< <.__annotate__s(( ($(rch<VF*pVS9dSV,SV&KSPVR4K, R#r*)pop)rrrrs& r_take_from_disk3_merge_pool_row_generation.._take_from_disks3E " *5 1u  5$' r last_statusfailure_reason) rrrany_merge_disk_cooldown_stater_POOL_TOKEN_GENERATION_FIELDSrq_POOL_STATUS_FIELDS) rrrnrrr merge_disk disk_pairrrs &f&$$ @r_merge_pool_row_generationrs2'ZJ&z2II)2H)%[II %[F((12 eii 6+E@-@/?@A %fj FFrc(V^8dQhRRRRRRRR/#)rrrrrrnrrr)rs"rrrs,// /'?/NQ//rc\V\4'gV#^RIHpHpHpHpHp^RIH pV!VPR4VPR44p V 'd /VCRV /CMTp \U u/uFqVPV 4bK p p V!VPR44;'gRp V!VPR44;'gRpVPR4WE39d W8d/V CV C#VPR4pWV39dV #VPR4;'gR pVPR4;'gR pV'dV'd VV8wdV#V!VPR44;'gRpVV 8:dV #W8Xd8V!VPW!44pVeV\P!48:dV #/V CV C#uup i \dTu#i;i) aKKeep a newer on-disk cooldown/quarantine over a stale in-memory one. ``write_credential_pool`` persists an in-memory snapshot that may predate another process marking the same credential exhausted/dead; without this merge the later rewrite resurrects a rate-limited key as healthy and both processes resume hammering it. The mirror image is a ``hermes auth reset`` that postdates the snapshot's cooldown (``status_cleared_at`` newer than its ``last_status_at``): the disk row wins there too, or a live session's next ordinary flush would write the reset cooldown straight back (#89415).)PooledCredentialrSTATUS_EXHAUSTED_exhausted_until_parse_absolute_timestamp)merge_model_cooldownsmodel_cooldownslast_status_atgstatus_cleared_atrrr)r+rrrrrrr%agent.credential_pool_model_cooldownsrrqr from_dictrLr)rrrnrrrrrrmerged_cooldownsrfdisk_status_fieldsmem_ts cleared_ts disk_status mem_access disk_accessdisk_tsuntils&&& rrrs j$ ' ' "  P0@Q1RTYT]T]^oTpqCS?E?,.>?Y^Q/RSZZWZ 99] # 'F F:K^3f3 23 3 nn]3 ,<= =MYY~.44"  nn^4:: +* *CL+JNN;K,LMTTQT f M  *$%5%?%? %XYE} 4 /&/.//-Q.  srAG G /G G ) G %G 0G G #G > G G G G 8 G  epoch 0) as a stale snapshot and copy a still-binding cooldown back.rdr)rrNr) rZrrr+rrrqrrsetrrr)rnrrrrridremovedbasesrzrr sanitized existing_listexisting_by_idnew_idscidrrrdisk_ids&&$$$ rwrite_credential_poolrGs +00b090sSss0G9   2E   %' j*;<EOqRVDWDW 0 @]^ ^ - )3M4)H)H b #M2j+,*<*B*B*BK*B#s##*BK( !T"" '%%aeeDk2K))AEE$K0 uuT{n<  )*  *  ( (J.8T.J.JjnnT*PTGw7'1gW6L B:{[\(#$3  : L(    sZ HHH,H AH$ H 2H 8H>A>H<5H6H?H/HH H' c$V^8dQhRRRRRR/#)r suppressedrrnrrzOptional[list[str]]r)rs"rrrss"   S M` rcVPV4p\V\4'dV#\V\4'd&VUu.uFp\ V4NK upW&W,#R#uupi)zCanonical (list-form) suppressed sources for *provider_id*; a legacy mapping (keys = source names) is migrated to the list form in place.N)rqr+rrr)rrn raw_sourcesrs&& r_suppressed_source_listrss_..-K+t$$+t$$9D"E3t9"E && #FsA'c$V^8dQhRRRRRR/#)rrnrryrrr)rs"rrrs! % %C % % %rc\4;_uu_4\4p\VR4p\W04pVf.;qCV&W9dVP V4\ V4RRR4R# +'giR#;i)z@Mark a credential source as suppressed so it won't be re-seeded.suppressed_sourcesN)rZrrrrrrnryrzr provider_lists&& rsuppress_credential_sourcer sh   %' #J0DE / H  68 8M{3  &   ($    s AA++ A< c$V^8dQhRRRRRR/#rrnrryrrr)rs"rrrs!c34rcV\4PR/4PV.49# \dR#i;i)z=Check if a credential source has been suppressed by the user.rF)rrqr)rnrys&&ris_source_suppressedr$sD)+//0DbIMMk[]^^^ s ,/ >>c$V^8dQhRRRRRR/#r"r)rs"rrrs!c34rc\4;_uu_4\4pVPR4p\V\4'g RRR4R#\ W04pVeW9d RRR4R#VP V4V'gVPVR4V'gVPRR4\V4RRR4R# +'giR#;i)zLClear a suppression marker so the source will be re-seeded on the next load.rNFT) rZrrqr+rrremoverrrs&& runsuppress_credential_sourcer(s   %' ^^$89 *d++   0 H  F$?   V$ NN; - NN/ 6$    s#3C C 0C  C #C  C c V^8dQhRRRR/#)rrnrrrr)rs"rrrsAAA1IArc*\\4V4#)zSPersisted auth state for a provider (profile first, global-root fallback), or None.)rr)rns&rget_provider_auth_stater+s  0 2K @@rcV^8dQhRR/#)rrrr)rs"rrrs66d6rc\R4;'g/pTPR4p\T\4'gR#\ TP 49# \dR#i;i)aReturn True if the currently-held Nous token carries ``billing:manage``. Reads the persisted ``scope`` string saved at login (``_save_provider_state`` stores ``token_data.get("scope") or scope``). A space-delimited match. Used by the lazy step-up: if False, the first billing call will 403 ``insufficient_scope`` anyway, but checking up front lets a surface skip a doomed round-trip. rFr)r+rrqr+rrr%)rrs rnous_token_has_billing_scoper.s^'/552 IIg E eS ! ! $ 55 sAA A&%A&cV^8dQhRR/#rrrzr)rs"rrrs55]5rc4\4PR4#)z8Return the currently active provider ID from auth store.rg)rrqrrrget_active_providerr2s   ! !"3 44rc V^8dQhRRRR/#rrrrrr)rs"rrrs11C1D1rc\4PR4;'gRP4P4p\ V4;'dW8H#)rgr)rrqrrr)ractives& r_active_provider_isr7sE $$%67==2 D D F L L NF < 0 0F00rc$V^8dQhRRRRRR/#)rslotr rrrrr)rs"rrrs&aaaaarc\V\4;'d;VPR4;'gRP4P 4V8H#)rr)r+rrqrr)r9rs&&r _slot_selectsr;s@ dD ! ` `txx ';'A'Ar&H&H&J&P&P&RV`&``rc V^8dQhRRRR/#r4r)rs"rrrsVVVVrcaa^RIHpV!4p\VPR4S4'dR#VPR4p\ V\ 4'd_\ ;QJd-V3RlVP44F 'gK RM" RM!V3RlVP444'dR#RV3RlloVPR 4p\ V\ 4'gR#VPR 4p\ V\ 4'dVP4MR pS!V4;'g;\ ;QJdV3R lV4F 'gK R# R#!V3R lV44#) aconfig.yaml ``model.provider``, or a MoA advisor/aggregator slot naming the provider. MoA presets are explicit model selections too: ``provider: anthropic`` in a MoA slot opts into Anthropic credentials for that slot even when the main model is another provider; otherwise Claude Code OAuth entries get pruned by ``load_pool("anthropic")`` and MoA advisors fail with "no ANTHROPIC_API_KEY" while the picker says Anthropic is logged in.rrT auxiliaryc3<<"TFp\VS4xK R#5ir*r;r,srs& rr.+_config_selects_provider..s(`O_!q*)E)EO_Fc V^8dQhRRRR/#)rblockr rrr)rs"rr._config_selects_provider..__annotate__sCC#C$CrcR<\V\4;'d\;QJd8V3RlVPR4;'g.4F 'gK RM- RM)!V3RlVPR4;'g.44;'g\ VPR4S4#)c3<<"TFp\VS4xK R#5ir*r@rAs& rr.G_config_selects_provider.._moa_block_matches..sZ6Y a,,6YrDreference_modelsTF aggregator)r+rrrqr;)rFrs&r_moa_block_matches4_config_selects_provider.._moa_block_matchess%&CC CZeii@R6S6Y6YWY6YZCCCZeii@R6S6Y6YWY6YZ Z B BUYY|4jA Crrpresetsc34<"TF pS!V4xK R#5ir*r)r,prMs& rr.rCs-UW.@.C.CWsr)rErr;rqr+rrvalues)rrcfgaux_cfgmoa_cfgrOrMsf @r_config_selects_providerrVs. -CSWWW%z22ggk"G'4  SS(`w~~O_(`SSS(`w~~O_(`%`%`CC ggenG gt $ $kk)$G",Wd";";gnnG g & U U##-UW-U##U#U#-UW-U*UUrc V^8dQhRRRR/#r4r)rs"rrrs]]S]T]rc\;QJd%R\V44F 'gK R# R#!R\V444#)zPool rows from EXPLICIT Hermes flows (manual add / device-code / PKCE) or live env keys; ambient borrowed sources (gh_cli / claude_code / qwen-cli) are deliberately excluded.c38"TFp\V4xK R#5ir*)_pool_entry_is_explicit)r,rs& rr./_explicit_pool_entry_present..s\;[%&u--;[sTF)rr)rs&r_explicit_pool_entry_presentr\s; 3\;OPZ;[\33\3\3\;OPZ;[\ \\rc V^8dQhRRRR/#)rrrrrr)rs"rrrs F Fc Fd FrcD^RIHp\V!V4;'gR4#)uTrue when *name* resolves to a usable secret in the active profile scope. Must not read raw ``os.getenv``: under ``hermes serve`` / Desktop multiplex the process environ is the *launch* profile, so a DeepSeek key pasted into another profile's ``.env`` would be invisible to ``explicit_only`` Settings → Model until a Bot-chat Refresh ran against that profile's own backend. Same reader as the credential resolver (``get_env_value_prefer_dotenv``: the current HERMES_HOME ``.env`` first, then the scope-checked environ) so the gate and the key that actually authenticates never disagree — an empty ``DEEPSEEK_API_KEY=`` export in the parent shell must not hide a real key in ``.env`` (#77007). r;r)rEr<rj)rr<s& r _env_secretr_s > 8>DD" EErc V^8dQhRRRR/#r4r)rs"rrrs#$rc\PV4pVf^RIHpV!V4pV'gR#VPR8XdI\ ;QJd&RVP 4F 'gK R# R#!RVP 44#VPR8Xd2\R4;'g\R4;'d \R 4#R#) u?True when the user has pasted an explicit credential env var for *normalized*. Falls back to the models.dev ``ProviderDef`` (same shape) for non-registry providers such as openrouter. AWS SDK providers are checked via explicit env vars only — NOT boto3's chain, so ambient EC2 IMDS / SSO profiles never auto-surface.) get_providerFrc3P"TFq\9gK\V4xK R#5ir*)_IMPLICIT_ENV_VARSr_r>s& rr.4_explicit_env_credentials_present..s c+CaPbGb>;q>>+Cs &&Tr&AWS_BEARER_TOKEN_BEDROCKAWS_ACCESS_KEY_IDAWS_SECRET_ACCESS_KEY)r/rqhermes_cli.providersrbrrrr_)rrrbs& r!_explicit_env_credentials_presentrjs  ##J/G5z*I%sc7+C+Ccsscscsc7+C+CcccI%56WW + , U U=T1U W rc V^8dQhRRRR/#)rrr rrr)rs"rrrs _ _3 _4 _rc\V\4'gR#\VPR4;'gR4P 4P 4pVP R4'dVVPRR4PR^4^,P 4p\T;'d \V44#\V4;'d#V\9;'gVP R4#)zZTrue for pool rows the user created via an explicit Hermes flow (or a still-live env key).Fryrzenv::zmanual:) r+rrrqrrrYr%rr__EXPLICIT_POOL_SOURCES)rryrs& rrZrZs eT " " 8$** + 1 1 3 9 9 ;F   ))Hb)//Q7:@@BG44 G 455 < ^ ^V'==]]ARARS\A]^rc V^8dQhRRRR/#r4r)rs"rrr(scdrc4V\9d^RIHp\V!44#VR8Xdp^RIHpV!4P R4p\V\4;'d<\\VP R4;'gR4P44#R#)ahVertex / Bedrock count as explicit when Hermes-scoped routing config is present. Uses has_explicit_vertex_config(), NOT has_vertex_credentials(): the latter also counts an ambient GOOGLE_APPLICATION_CREDENTIALS path (commonly set for unrelated GCP work). Only Hermes-scoped signals (VERTEX_PROJECT_ID / vertex.project_id / VERTEX_CREDENTIALS_PATH) count here.)has_explicit_vertex_configr%rrrF) _VERTEX_PROVIDER_IDSagent.vertex_adapterrqrrErrqr+rrr)rrqr bedrock_cfgs& r%_keyless_provider_has_explicit_configru(sy))C.011Y1!m'' 2 +t,ccc+//(:S:Y:YWY6Z6`6`6b1cc rz.tuple[tuple[Callable[[str], bool], bool], ...]_EXPLICIT_CONFIG_CHECKSc V^8dQhRRRR/#rr)rs"rrrBs34rcT;'gRP4P4p\Fwr#V!V4'dR#K R# \d6pT'gh\P RTP Y4Rp?KXRp?ii;i)afTrue only if the user explicitly configured this provider: auth.json ``active_provider``, config.yaml ``model.provider`` / MoA slots, a pasted provider env var, a pool entry from a Hermes-initiated flow, or Hermes-scoped routing config for keyless cloud-SDK providers. Ambient borrowed credentials (gh CLI, qwen-cli, ~/.claude/.credentials.json) never count.rTz*explicit-config check %s failed for %s: %sNF)rrrvrr|rlr)rnrcheck best_effortrs& r!is_provider_explicitly_configuredr{Bs ##**,224J5 iZ  !6   i LLEu~~Wb h h isA  B *BB c V^8dQhRRRR/#rrnrzrrr)rs"rrrSs]drc|\4;_uu_4\4pT;'gVPR4pV'g RRR4R#RpRFp\W4pW%9gKWRRpK VPR4V8XdRVR&RpV'd \ V4VuuRRR4# +'giR#;i)zClear auth state for a provider (the active one when *provider_id* is None). Used by ``hermes logout``. Returns True if something was cleared.rgNFT)r^rd)rZrrqrr)rnrzrrclearedrrs& rclear_provider_authrSs   %' AA /@ A   7G$Z9G O 8 >>+ , 6,0J( )G  Z (!    s#-B*B* B*&,B* B** B; cV^8dQhRR/#rrrr)rs"rrris%%T%rc\4;_uu_4\4pRVR&\V4RRR4R# +'giR#;i)zClear active_provider without deleting credentials: used when the user switches to a non-OAuth provider (OpenRouter, custom) so auto-resolution doesn't keep picking the OAuth provider.Nrg)rZrr)rzs rdeactivate_providerris7   %' (, $%$    s 8 A c V^8dQhRRRR/#)r provider_namerrr)rs"rrrusrcH\T;'gR4P4P4R 9dR#^RIHpV!4pV'gR#R.pVFpTP RVP R8XdRMR R VP 24VP'gKKVPP4^,'gKtVP R VPP4^, 24K R PV4# \dR#i;i) zfree opencode_free opencode-free) rrrrErrseveritymessagerS splitlinesr~r)rrissueslinescis& r%_get_config_hint_for_unknown_providerrus =  B%%'--/3]]Q ?*,VWB LL3"++*@wiPPRSUS]S]R^_ `www277--/22 x(:(:(/.)list_providers)rrr^raliasesrrr)r_lp_pp_aliass r_plugin_aliasesrsa$%G 35C++""6884& N   N sAA A$#A$cV^8dQhRR/#)rrCallable[[str], str]r)rs"rrrs22 42rch^RIHpV# \d\P RR4Ru#i;i)a Scope-aware key reader for provider auto-detection. Under multiplex a secondary profile's keys live only in its secret scope, not os.environ. Catch ONLY ImportError: any other auxiliary_client failure must propagate rather than silently falling back to os.getenv (a traceless fail-open)._scoped_key_envuagent.auxiliary_client unavailable (%s); provider auto-detection will read keys from the process environment only — under multiplex, secondary profiles may report 'No LLM provider'.z import failedcB\P!V4;'gR#r)rgetenv)rs&r(_scoped_key_env_reader..sBIIdO11r1r)agent.auxiliary_clientr ImportErrorr|r}rs r_scoped_key_env_readerrs@ 2 ; 2 J    21 2s  $11c V^8dQhRRRR/#)rscoped_key_envrrrr)rs"rrrs.Btrc6\V!R44'dR#V!R4p\V4'd\V4'dR#^RIHp\ V!R4P 44# \ d"p\PRT4Rp?R#Rp?ii;i) zTrue when an OpenRouter credential exists via env key or the credential pool (a key added via `hermes auth add openrouter` has no env var; without the pool check it is invisible to auto-detection and requests go out with no Authorization header).OPENROUTER_API_KEYTOPENAI_API_KEYrrkz.Could not check OpenRouter credential pool: %sNF) rjrwrrrrrr|rl)r legacy_key _load_poolrs& r_openrouter_auto_detectedrs(<=>> 01J$$)B:)N)N  BJ|,<<>??  EqIs$A,, B7BBskip_free_tierc V^8dQhRRRR/#)rrrrrzr)rs"rrrs    rch\4PR4pVR8Xd-^RIHpHpV!4'dV'gV!4'gR#V'd.V\ 9d#\ V4PR4'dV#R# \d"p\PRT4Rp?R#Rp?ii;i)zTauth.json ``active_provider`` when it is a registry provider that reports logged in.rgr)free_inference_active has_guestN logged_inz+Could not pre-read active auth provider: %s) rrqhermes_cli.anon_authrrr/get_auth_statusrr|rl)r_mayberrrs$ r _logged_in_oauth_active_providerrs G!#''(9: V  M{{6K6M6M f 11of6M6Q6QR]6^6^M  G BAFF Gs-4BB BB,B B1B,,B1cV^8dQhRR/#)rrztuple[Any, Optional[str]]r)rs"rrrs'' 9'rc*^RIHpV!4;'g/PR4p\V\4'dVPR4MRp\V\ 4'dVP 4P4MRp\4PW"4pVR8XgVPR4'dVR3#VR8Xg V\9dW3#V'd^R I H pV!V4'dVR3#\V\4'd3\ VPR 4;'gR4P 4MRpV'd^R I HpV!WB4'dVR3#VR3# \d#p\ P#R T4R uRp?#Rp?ii;i)a``(model_cfg, provider)`` from config.yaml when ``model.provider`` names a registry provider or a custom OpenAI-compatible endpoint (``custom``, ``custom:``, ``vllm``/``ollama``/...). A ``model.provider: openrouter`` pin and a bare ``providers:`` entry name are explicit intent too. The normal chat/gateway path resolves config.provider upstream in resolve_requested_provider(); this is the safety net for the direct ``resolve_provider("auto")`` callers. A configured custom endpoint is explicit intent like any registry pin: without this rung the boot inventory (``free_tier_bootstrap``) read a llama.cpp/vLLM install as "nothing configured" and the dashboard's Ink chat parked every session on Setup Required while ``hermes chat`` worked (#108383).rrrNrrrrk)has_named_custom_providerr),_config_base_url_trustworthy_for_bare_customzACould not read config.yaml model.provider for auto-resolution: %sr)rErrqr+rrrrrrYr/"hermes_cli.runtime_provider_customrhermes_cli.runtime_providerrrr|rl)rrrrrrrs r_config_model_providerrsW1 ]((b--g6 0:9d0K0K9==,QU/9(C/H/H8>>#))+b"$((< x 8#6#6y#A#Ah& & | #x3D'D& &  T(22 (**DNiY]C^C^3y}}Z066B7==?df  `;HOO (**$  XZ[\sYE%B'E%>E%E%E%E%3E%72E%*E% E%!E%% F0F F Fc$V^8dQhRRRRRR/#)rrr oauth_activerzrr)rs"rrrFs$(8EJWrc &\P4Fxwr#VPR8wg V\9dK#VPFEp\ V!V44'gKV'dW8wd\ PRW$W4Vuu# Kz R#)zFirst registry api_key provider (registry order) with a usable env key, warning when it preempts a logged-in OAuth provider so a stale key in ~/.hermes/.env never switches silently.rzProvider resolved to %r via %s, preempting your logged-in OAuth provider %r. If you meant to use the OAuth login, unset %s or set `model.provider` explicitly.N)r/rr_NO_AUTO_DETECT_PROVIDERSrrjr|r})rrr+rrs&& r_env_key_auto_detectedrFs~*//1     )S4M-M //G !899L$7NN&l= 02 rexplicit_api_keyexplicit_base_urlc ,V^8dQhRRRRRRRRRR/#) r requestedrzrrrrrrr)rs"rrr]sC['['['$['% ['  [' &) ['rcT;'gRP4P4p\4PWD4pVR9g\ V4eV#VR8wd3\ V4pV'dRV 2MRp\ RV R2V,RR 7hV'g V'dR#\4wrxV'dV#\4p \V 4'd \4R#\VR 7p \W4p V 'dV #V 'dN\V\4'd6V'd.VPR 4'g\P!R V 4V #V'g^R IHp V !4'dR#^RIHp^RIHpV!V!4'*R7'dR#^RIHp\ RV!4 R2RR 7h \&d!p \P)RT 4Rp ? LkRp ? ii;i \0dLWi;i)aJDetermine which inference provider to use. "auto" priority (explicit intent beats a stale OAuth login): 1. CLI api_key/base_url -> "openrouter"; 2. config.yaml ``model.provider``; 3. OPENROUTER_API_KEY (or an sk-or- key in OPENAI_API_KEY) -> "openrouter"; 4. OpenRouter pool; 5. provider env keys; 6. auth.json ``active_provider``; 7. Nous free tier when a claimed guest exists on the desktop's local backend (never created here); 8. AWS Bedrock chain; 9. AuthError(no_provider_configured). ``skip_free_tier`` hides rungs 6-for-a-free-tier-identity and 7: the boot bootstrap asks "what would carry inference if the free tier did not exist?" to decide whether a fresh identity may become ``active_provider``. 1. 3. 4. 5. Provider-specific API keys (GLM, Kimi, MiniMax, ...) -> that provider 7. 8. Error (no provider configured) See #29285. rrkNz z` Check 'hermes model' for available providers, or run 'hermes doctor' to diagnose config issues.zUnknown provider 'z'.invalid_providerr)rrzProvider resolved to logged-in OAuth provider %r because config.yaml `model` has no `provider` key. If you meant a different provider, set `model.provider` explicitly.)rrz6free tier check during provider resolution skipped: %shas_aws_credentials)on_local_desktop_backend)instance_metadatar%)display_hermes_homezHermes is not connected to any AI provider yet. Run `hermes model` to pick one, type `/login` in chat, or add a key with `hermes auth add `. (Advanced: put an API key such as OPENROUTER_API_KEY in z/.env.)no_provider_configured)rkr)rrrrqrrrrrrrrrr+rr|r}rrrrlagent.bedrock_adapterrrrrr)rrrrrrSra _model_cfg cfg_providerr _oauth_activeenv_pidrrrrrs&$$$ rrr]s*%%v,,.446J "&&z>J--1A*1M1YV4Z@!%$tf ,D,ZL;dBI[\\,57J,.O 11.05NSM$_DG  j$ ' 'Jz~~j?Y?Y NNG     X B$&&'  =A 5M5O1O P P Q5  s  ! *&  '' X LLQSV W W X    s*F:6$G(: G%G  G%( G65G6cV^8dQhRR/#r9r)rs"rrrs@@C@rcr\P!\4P4P RR4#)zQCurrent UTC time as an ISO-8601 string with a ``Z`` suffix (last_refresh format).+00:00Z)r r}r r~r^rrr _utc_now_zr s' <<  & & ( 0 03 ??rc V^8dQhRRRR/#)rrJr rzOptional[float]r)rs"rrrs    rcf\V\4'dVP4MRpV'gR#VPR4'd VRRR,p\P !V4pTPfTP\R7pTP4# \ dR#i;i)rNr r )tzinfo) r+rrrZr fromisoformatrrr^r timestamp)rJtextrs& r_parse_iso_timestamprs&uc225;;=D  }}SCRy8#''-}}s+     sB!! B0/B0c$V^8dQhRRRRRR/#)rexpires_at_isor skew_secondsrfrrr)rs"rrrs&RRRCRDRrcn\V4pVRJ;'g V\P!4V,8*#r*)rrL)rr expires_epochs&& r _is_expiringrs/(8M D Q QMdiikL6P$QQrc V^8dQhRRRR/#)rverifyr rrr)rs"rrrscc3c>crcDRVRJR\V\4'dV/#R/#)zAPersistable ``tls`` block derived from an httpx ``verify`` value.insecureF ca_bundleN)r+r)rs&r_tls_state_from_verifyrs+ % 6SV@W@Wf bb]a bbr default_codec ,V^8dQhRRRRRRRRRR /#) rrrrrreasonr rzrrr)rs"rrrs4---#-03-CP--rcRTR\V4RTRRRVf VPMVP;'gTR\P!\4P 4/#)zQThe ``last_auth_error`` record persisted when dead OAuth material is quarantined.rrr"rTrat)rrr r}r r~)rrr"r s&&$$r_last_auth_error_markerr%sX HiUXvGY[_l2 9S9S| hll3))+ --rc(V^8dQhRRRRRRRR/#) rrrrrrrrrr)rs"rrrs/XXX#XIXZ^Xrcf\FpVPVR4K \WRRR7VR&R#)zStrip dead tokens from a flat OAuth state after a terminal runtime refresh failure so subsequent calls fail fast without a network retry (mirrors the Nous / xAI / Codex pattern).Nruntime_refresh_failurerefresh_failed)r"r last_auth_error)_FLAT_OAUTH_TOKEN_KEYSrr%)rrr_ks&&& r_quarantine_flat_oauth_stater-s6% "d%67FV XE rc V^8dQhRRRR/#)r expires_inr rrfr)rs"rrrsCCrcR\^\V44# \d^#i;i)r8)rNrfr)r/s&r_coerce_ttl_secondsr1s*1c*o&& s  &&c V^8dQhRRRR/#)rrJr rrzr)rs"rrrscmrc\V\4'd VP4PR4MRpT;'gR#)rrN)r+rrr)rJris& r_optional_base_urlr4s2+5eS+A+Aekkm""3'rG ??drfrozenset[str]_NOUS_PORTAL_ALLOWED_HOSTSzdict[str, tuple[float, str]]_RESOLVE_TOKEN_CACHE@r<.@rrrefresh_skew_secondsc ,V^8dQhRRRRRRRRR R /# rr<r=rzOptional[bool]rrzr:rfrrr)rs"rrr s> 4 4 4 4 4  4 GJ 4rc4aaaa^RIHpV!VVVV3Rl4#)aRefresh-aware Nous Portal token for managed tool gateways, connectors and account reads, never the free model: a guest gets a live held token, else a connectors-only mint NAS never challenges. Only a NAS from before hermes-portal#1516 challenges that mint; it is worked here as before.)run_with_challengec"<\SSSSR7#))r<rrr:)_resolve_nous_access_token)rrr:r<srr+resolve_nous_access_token..s&@'(i1'3r)hermes_cli.anon_challenger>)r<rrr:r>sdddd rresolve_nous_access_tokenrC s= 3 44rc ,V^8dQhRRRRRRRRR R /#r<r)rs"rrrsCM0M0M0M0 M0  M0 #& M0rcaaaaaV'*;'dVRJo\4oS'df\;_uu_4\PS4pRRR4Xe6\P !4V^,, \ 8d V^,#RVV3Rllp\R4;_uu_4woooS'g\RRRR7h\S4p\SPR4;'g\4p\WSR 7pVVV3R lp \VR ,\4p \V R 7;_uu_4^R IHp Hp Hp V !S4'dV !SVR7;p'dV!V4uuRRR4uuRRR4#\(P*!\(P,!T;'gR4RR/VR7;_uu_4pV !SVRR7pRRR4V !4\/S4V!X4uuRRR4uuRRR4#\1S4pSPR4pSPR4p\3V\4'd V'g\RRRR7h\5SPR4V4'g,V'dV !4V!V4uuRRR4uuRRR4#\3V\4'd V'g\RRRR7h\(P*!\(P,!T;'gR4RR/VR7;_uu_4p\7VSSVVVRV R7pRRR4\9SXV4VSR&VSR&\;V4SR&V !4\/S4V!SR,4uuRRR4uuRRR4# +'giELG;i +'giEL;i +'giL;i +'giM;iRRR4R# +'giR#;i) Nc V^8dQhRRRR/#)rrrrr)rs"rr0_resolve_nous_access_token..__annotate__+sSSrc<S'd8\;_uu_4\P!4V3\S&RRR4V#V# +'giT#;ir*)_RESOLVE_TOKEN_CACHE_LOCKrLrMr7)rrmemoables&r_memo)_resolve_nous_access_token.._memo+s? **37>>3CU2K$Y/+ u +* s A A rz&Hermes is not logged into Nous Portal.nous_auth_missingT)reloginr)rr auth_statec <\SRSS4#)r)r)rzrstate_source_pathsrr,_resolve_nous_access_token..7s8 '8:rr8)r<)held_connectors_tokenis_guest_staterefresh_guest_state)rr9Acceptzapplication/json)timeoutheadersr connectors)purposerrz,No access token found for Nous Portal login.nous_auth_missing_access_token expires_atz2Session expired and no refresh token is available.nous_auth_missing_refresh_token$managed_access_token_refresh_failure)clientrzrrrrr"persistrtls)rrIr7rqrLrM_RESOLVE_TOKEN_CACHE_TTL_SrrrKrrr2rNrrMrrSrTrUrClientTimeoutrZrEr+rrTr?r)r<rrr:rrKrrrr` lock_timeoutrSrTrUrr_minted merged_sharedr refreshedrzrrJrrQs$$$$ @@@@@rr@r@sY|11 T 1H!I & &)--i8F'  4>>#3fQi#?C]"]!9  %V , ,0VUDUDFYcgh h/6 +.HH2HI  (TYZ:?S02KL $\ B B g ge$$#8Ma#bb<b . C B - , \\%--8O8O4*P+35G*HQWYY\b0 UFY (/V}C B - ,.;5AM 99^4L!IIo6MlC00 BDdnrtt  , 79MNN I\*5C B - ,LmS11HJk ""emmO4K4Kt&L'/1C&DVUUX^7!jWf'}A7T U ) = I'6E# $!*E+ 1&9E%L I $U +~./]C B - ,' & &6YYY6UUCC B B - , , ,sN -AO&0A O&;*O &O - O&(O +O  N! !O 0 O&A O 6O O  O&*O 6O ?O N5 +A O 8 O& N ! N2, O 5 OO  O O&& O7 z)? ~6 YE*..1>>Y?@.RV-*..+[[ZJNN:. 00rcV^8dQhRR/#rr)rs"rrrs  ~ rc\R\RR\R7p\VP R4;'gR4P R4'd!^RIHpV!VP R 44VR &V#) zStatus snapshot for Codex auth (pool first, then legacy provider state). Read-only by contract: status/doctor must never adopt, refresh or persist a credential (#68004).rrc\RR7#)T) read_only)rrrrr'get_codex_auth_status..s 9DIr) is_expiringrr on_pool_missryrr)_codex_pool_route_base_urlr)rOr}rrrqrYhermes_cli.auth_codexr)rxrs rrrse&$CyI46F 6::h  % %2&11'::D7 :8NOz MrcV^8dQhRR/#rr)rs"rrrsZZ>Zrc*\R\RRR7#)rrc\RR7#)F)refresh_if_expiring)r|rrrr+get_xai_oauth_auth_status..s =RWXr)rrr)rOrtrrrrrs $!>J]X ZZrc V^8dQhRRRR/#)rrrrrr)rs"rrrs _ _N _s _rcVPR8Xd^RIHp\4P R4p\ V\ 4'dlT!\VP R4;'gR44R8Xd=\VP R4;'gR4P4pV'dV#VP'd0\P!VPR4P4#R#)r)normalize_providerrrrr) rrirr3rqr+rrrrrr)rrrconfigured_urls& r_provider_env_base_urlrszzX;!%%g. eT " "'9#eii >S>Y>YWY:Z'[_g'g :!6!E>V>V>V299W--r 2 8 8 :^\^^rc V^8dQhRRRR/#rrnrrrr)rs"rrr s77S7^7rc \V4pV'dVPR8wdRR/#\W4wr#\V4pVR 9d\ W!P V4pMT;'g VP pRpVR8Xd&\ V4pV'*;'d \V4p\V4;'gTpRTRTRVPRT;'g V'dRMR R VR V/#) zr r ) rrrrr!rrrrr)rnrrrenv_urlractual_local_noauthrs& rget_api_key_provider_statusr s{+G g''94e$$:;PG$W-G77)'3M3MwW88g88h,X6")kPP.Fx.Pg55"5Jj*k67<<jTT8K_QSHk: 77rc$V^8dQhRRRRRR/#)rrnrresolved_commandrzrtuple[bool, Optional[str]]r)rs"rrrs' Y Y Y YZt YrcFVR8Xd \4#V'dRRV 23#R#)aGBest-effort POSITIVE evidence ``(verified, source)`` that an external-process CLI is authed. False means "not verifiable from here", NOT "signed out". Subprocess-free (spawning the CLI from status endpoints/pickers re-creates the cold-start stall copilot_auth.py avoids). Generic evidence for any external-process profile is its binary resolving: the subprocess owns real auth and Hermes has nothing else to inspect, so out-of-tree ACP rows pass credential-gated surfaces (Desktop ``explicit_only`` picker) like the bundled one, whose CLI additionally exposes readable token stores.rTz command: FN)_copilot_acp_auth_evidence)rnrs&&r_external_process_auth_evidencers0m#)++5EDI./0 1X=XrcV^8dQhRR/#)rrrr)rs"rrr,s!!$>!rcH^RIHpHpVFPp\P!VR4P 4pV'gK2V!V4^,'gKIRRV 23u# \PPR4p\PPV4'Ed\VRR R R 7;_uu_4pR PR VP4P444pRRR4XP 4'd\ P"!V4M/P%R4p\'V\(4'dY\*;QJd*RVP-44F 'gK RM RM!RVP-444'dR#RFtp \PPT 4p \PPT 4'd-\PP/T 4^8dRT 3u#KtKv R# \ d"p\PRT4Rp?ELRp?ii;i +'giELg;i \ d!p\PRT4Rp?LRp?ii;i \0dKi;i)zaCopilot CLI token stores readable without spawning it (env tokens, plaintext config, hosts.json).)COPILOT_ENV_VARSvalidate_copilot_tokenrTzenv: z/copilot-acp env token evidence check failed: %sN~/.copilot/config.jsonr-rignorer r0c3r"TF-qP4PR4'dK)VxK/ R#5i)z//N)lstriprY)r,lines& rr.-_copilot_acp_auth_evidence..=s) c%;T;;=C[C[\`CaDD%;s&7 7 copilotTokensc3r"TF-p\V\4;'dVP4xK/ R#5ir*)r+rrr>s& rr.r@s,0K:IQ 1c"00qwwy0/s77Fz0copilot-acp CLI config evidence check failed: %s)Tr)z#~/.config/github-copilot/hosts.jsonz"~/.config/github-copilot/apps.jsonr)rrrrrrrr|rlr expanduserisfilerKr~readrrhrirqr+rrrRgetsizer) rrrror cli_configfhrmtokens cred_pathexpandeds rrr,sMT'G))GR(..0Cs-c2155uWI...( NWW''(@A 77>>* % %j# HMMQSii c%'WWY%9%9%; ccN*-djjo"AA/RF&$''CC0K:@--/0KCCC0K:@--/0K-K-K55c  ww)))4Hww~~h''BGGOOH,E,IY&-J'c 1 M FLLMNMM N GMMN   s7H!H!H!H!!AI$&I$=5I2I$AI$I$:(I$#I$+A+J! I ,II  I!  I$$ J/J  J J! J!c V^8dQhRRRR/#)rrrrz:tuple[str, list[str], str, Optional[str], tuple[str, ...]]r)rs"rrrPs `` ` Z`rc\V4;'g VPp^RIHpV!VP4p\ \VRR 4;'gR 4p\\VRR4;'gR4p\RRV44R4;'g!\\VRR4;'gR4pV'd&\P!VR4P4MRpV'd\P!V4M\\VR R 4;'g.4p^R IHp WhW!V4V3# \ dRpELi;i) a``(command, args, base_url, resolved_command, command_env_vars)`` for an ACP provider. Launch details come from the provider's own profile (copilot-acp: HERMES_COPILOT_ACP_COMMAND / COPILOT_CLI_PATH / HERMES_COPILOT_ACP_ARGS), so out-of-tree providers describe their binary.)get_provider_profileNprocess_command_env_varsprocess_args_env_varrc38"TFq'gK VxK R#5ir*rr>s& rr.)_external_process_spec..^s^ X1\]QQ XrAc3l"TF*p\P!VR4P4xK, R#5irC)rrr)r,rDs& rr.r^s) XGW3!3!9!9!;!;GWs24process_command process_args) resolve_external_process_commandr)rrr^rrrrrrrFrrrshlexr%r hermes_cli.auth_external_processr) rr_get_provider_profileprofilecommand_env_vars args_env_varcommandraw_argsargsrs & r_external_process_specrPs' &g.LL'2L2LHK' 3WW.H"MSSQSTww(>CIIrJL^ XGW X^`bcEEgg'8"=CCD 6Bryyr*002H$,5;;x $wwXZ7[7a7a_a2bDQ ($DW$MO_ __ sD99 E  E c V^8dQhRRRR/#rr)rs"rrrfs\\c\n\rc\V4pV'dVPR8wdRR/#\V4wr#rEp\T;'gVP R44p\ W4wrRVRVRVP RVRVR VR VR VR VR V / #)zStatus snapshot for providers that run a local subprocess. ``configured``/``logged_in`` are structural (executable resolves or TCP endpoint set): the subprocess owns real auth. ``auth_verified``/``auth_source`` carry positive evidence only.rrF acp+tcp://rrrrrrr auth_verified auth_source)rrrrrYrr) rnrrrrrrW availablerrs & r$get_external_process_provider_statusrfs {+G g''+==e$$3I'3R0G8q%JJ)<)<\)JKI!@!_Mi[&',,PY[b(*:JY { \\rc V^8dQhRRRR/#)rrrrrrr)rs"rrrwsXXSX^XrcX^RIHpRV!4RV/# \d RRRTRR/u#i;i)uAAWS SDK providers (Bedrock) — check via boto3 credential chain.rrrFrzboto3 not installed)rrr)rrrs& r_get_aws_sdk_auth_statusrwsCX=02JGG XUJAVWWXs ))c V^8dQhRRRR/#rr)rs"rrrs   . rcT;'g\4;'gRP4P4pV'gRR/#\P V4pV'd\ 4V,!4#\ V4pV'dBVP\9d-\ 4\VP,,!V4#RR/#)aPGeneric auth status dispatcher: bespoke builders (``OAUTH_PROVIDER_FLOWS`` plus Azure Foundry) first, then the registry ``auth_type`` so a whole provider class (e.g. every external-process ACP backend) gets a real status. Builders are looked up by NAME at call time so tests that patch ``hermes_cli.auth.get_*_auth_status`` still apply.rrF) r2rr_BESPOKE_STATUS_FUNCTIONSrqrrr_STATUS_BY_AUTH_TYPE)rnrrstatus_fn_namers& rrrs 880288b ? ? A G G IF U##.226:Ny(**v&G7$$(<<y-g.?.?@A&II  r_get_azure_foundry_auth_statusrrrrr5rcV^8dQhRR/#rr)rs"rrrs...rc RR/p^RIHpHpV!4p\ V\ 4'dVP R4MRp\ V\ 4'g/p\VP R4;'gR4P4P4;'gRpWPR&\VP R4;'gR 4P4VR&VR 8Xd^R I H pH pH pV!4p \ VP R 4\ 4'd VR ,M/p VPWR 7p TPYP RR\#V 4V 'dRMR\%R4 R2R7V#X!R4;'gR p \+V 4VR&V# \d/pELi;i \dp RTR&RT 2TR&Rp ? T#Rp ? ii;i \d\&P(!RR 4p Lni;i)uStructural auth status for Azure Foundry. ``entra_id``: ``azure-identity`` importable — never invokes the Entra credential chain (keeps CLI startup flat; ``hermes doctor`` runs the live probe). ``api_key`` (default): usable ``AZURE_FOUNDRY_API_KEY``.rr')rr<rNrrrrentra_id)EntraIdentityConfigSCOPE_AI_AZURE_DEFAULThas_azure_identity_installedentra) default_scopenot_runFzyazure-identity is installed; live credential validation is skipped here. Run `hermes doctor` to verify token acquisition.z@azure-identity not installed. From the Hermes environment, run: zazure-identityz. Then restart Hermes.)azure_identity_installedrcredential_probecredential_verifiedrrSrzazure-identity check failed: rAZURE_FOUNDRY_API_KEY)rErr<rr+rrqrrragent.azure_identity_adapterrrr rupdaterrrrrrj)inforr<rSrrrrr  installed entra_cfgidentity_configrrs rrrs '8DNm%/sD$9$9 tI i & & IMM+.;;)<BBDJJLYYPYI!9==4::;AACDJ B [ [46I.8w9OQU.V.V '*\^I1;;I;lO KK)2:O:Obk$)T)_XW#$4567++  - 9-.EFLL"*'2D KI 4 B %D ;C5ADM  B 9))3R89sBF!BF-7GG F*)F*- G8 G  G"G87G8c(V^8dQhRRRRRRRR/#rrrdefaultrrr)rs"rrrs(77s7S73737rc8V'dVPR4#T#)r)r)rrrs&&&r_default_api_key_base_urlrs")7>># 6w6rc(V^8dQhRRRRRRRR/#rr)rs"rrrs(  s S 3 3 rc\WV4p^RIHpHpV!4wrgV'd2V!V4^,;'gRP 4pV'dTpV# \ d"p \ PRT 4Rp ? T#Rp ? ii;i)zCopilot's API base comes from the token-exchange response (endpoints.api, proxy-ep fallback), authoritative for Enterprise / proxied accounts; falls back to the registry default.rrz4Copilot base URL resolution fell back to default: %sN)rrrrrrr|rl) rrrrrr raw_tokenrWresolvedrs &&& r_copilot_runtime_base_urlr s)7CHRX,. -i8;AArHHJH# O R KSQQ ORs".AAA B%BBc&\\V!4#r*)r ras*rrrs?@Y[\@]^rc&\\V!4#r*)rrr"s*rrrs23La3PQrz)dict[str, Callable[[str, str, str], str]]_API_KEY_BASE_URL_RESOLVERSc V^8dQhRRRR/#rr)rs"rrrs++c+n+rc \V4pV'dVPR8wd\RV R2VRR7h\W4wr#V'gVR8Xd\pT;'gRp\ V4p\ PV\4pV!W!PV4p\V4'g VPpV'g+VR8Xd$\V4'd\pT;'gR pR TRTR VPR 4R T;'gR/#)z5Resolve API key and base URL for an API-key provider.r Provider 'z' is not an API-key provider.rrrrrrrrrrry)rrrrrrr%rqrrrrrr)rnrrrr resolve_urlrs& r$resolve_api_key_provider_credentialsr+s{+G g''94 %B C '9; ;;;PG {j0-,,9 $W-G-11+?XYK7$>$>HH  " "-- {h.3KH3U3U122? KGZQTAU*))  ++rc V^8dQhRRRR/#rr)rs"rrr ss~rc \V4pV'dVPR8wd\RV R2VRR7h\V4wr#rEpV'g\VP R4'gEV'dRRP V4,MR p\R T R T;'gR R V R2VRR7hRTRVP ;'gTRVPR4RT;'gTRVRR/#)z>Resolve runtime details for local subprocess-backed providers.rr(z&' is not an external-process provider.rr)rz or set rrzCould not find the 'z' CLI command 'z(none configured)z '. Install itrmissing_external_process_clirrrrrryprocess)rrrrrYr~rr)rnrrrrrr_hints& r-resolve_external_process_provider_credentialsr1 s{+G g''+== %K L '9; ;CYY`Ba?G8/? H$7$7 $E$E;K SXX&677QS";-0.../}UG1 F / 1 1 KGJJ,E,E+HOOC()5E5P5PRXZ^) r clear_defaultc ,V^8dQhRRRRRRRRRR /#) rrnrr default_modelrzr2rrr r)rs"rrr( s4---*-->K--'+-rc\4;_uu_4\4pWR&\V4RRR4\4pVPP RRR7\ V4\4pVPR4p\V\4'd \V4pM%\V4'dRVP4/M/pWR&V'd,VP4'dVPR4VR &MVPR R4^R IHp V !V4V'd'VPRR 4p V 'dRV 9dW(R&MV'dVPRR4WR&\#WV4V# +'giELU;i) aUpdate config.yaml and auth.json to reflect the active provider. *default_model*, when given, is written as ``model.default`` in the same step so the gateway (which re-reads config per message) can't pick up the new provider before model selection finishes and send an OpenRouter-style ``vendor/model`` name to a direct API. *clear_default* removes ``model.default`` in that same write, for a caller that has no model to offer and must not leave the previous provider's model paired with the new host.rgNTrArrrrr) clear_model_endpoint_credentialsr)rZrrr2rErFr4r3rqr+rrrrrrEr6r0) rnrr4r2rz config_pathconfig current_modelrr6 cur_defaults &&&$ r_update_config_for_providerr;( sI   %' (3$%$  "#KTD9(5  FJJw'M-&&' :G :V:VY 3 3 56\^ 'j06688 2 9 9# > * j$'C$Y/mmIr2 c[0#0i  i&7O+. G   s E99 F cV^8dQhRR/#r0r)rs"rrrX sUUmUrcD\4pT'dTPR4MRp\T\4'dTPR4MRp\T\ 4'd)TP 4P4;'gR#R# \dR#i;i)z?Return model.provider from config.yaml, normalized, if present.Nrr)r3rrqr+rrrr)r8rrs r_get_config_providerr>X s "$*FJJw tE(25$(?(?uyy$TH1;Hc1J1JHNN  " " $ , ,TPTT s B BBc V^8dQhRRRR/#r}r)rs"rrrc sTTT4TrcT;'gRP4P4pV\9;'d\4V8H#)zWTrue when logout should reset model.provider (a registry provider config.yaml selects).r)rrr/r>rs& r'_should_reset_config_provider_on_logoutrAc s>##**,224J * * S S/C/E/SSrcV^8dQhRR/#r0r)rs"rrri sBBmBrc\4p\PT;'gR4pV'dVP'dV#R#)uFallback logout target when auth.json has no active provider but config.yaml still selects an OAuth provider (e.g. openai-codex) — otherwise logout said "No provider is currently logged in" and never reset model.provider.rN)r>rrqr)rflows r$_logout_default_provider_from_configrEi s:$%H  # #HNN 3D 7 7 78ATArcV^8dQhRR/#rr)rs"rrrr src\4pVP4'gV#\V4\4pV'gV#VP R4p\ V\ 4'dRVR&RV9d \VR&\W4V#)z5Reset config.yaml provider back to auto after logout.rrrr) r2rr4r3rqr+rrr0)r7r8rs r_reset_config_providerrHr s}!#K     (5  F  JJw E%"j   3E* +. rcV^8dQhRR/#rr)rs"rrr s4rc.\R4\^4h)z9Deprecated: use 'hermes model' or 'hermes setup' instead.zThe 'hermes login' command has been removed. Use 'hermes auth' to manage credentials, 'hermes model' to select a provider, or 'hermes setup' for full setup.)print SystemExit)rs&r login_commandrM s  ST Q-rcV^8dQhRR/#rr)rs"rrr s X X~ Xrc p\R4pV'dVPR4'gRRRR/#\P!VPRR44P 4\ P !48pRVRRR VPR R 4RVPR4/# \ dRpL8i;i) z3Return auth status dict for MiniMax OAuth provider.rrrFrr\rTrr)r+rqr rrrLr)r token_valids rrr s #O 4E  .11UJ@@,,UYY|R-HISSUX\XaXaXcc  [*o%))Hh/uyy?V XX  sA B%% B54B5cV^8dQhRR/#rr)rs"rrr s!K!KD!Krc\VRR4pV'd+\V4'g\RV 24\^4hT;'g\ 4;'g \ 4pV'g\R4R#VR8Xd-^RIHpHpV!\R44'd\V4R#\V4p\V4p\V4'gV'g\RV R24R#VR8Xd^R I HpV!R 4V'd \4\R V R24V'g\R 4R#\ P"!R 4'd\R4R#\R4R#)z Clear auth state for a provider.rNzUnknown provider: z#No provider is currently logged in.r)FREE_TIER_NOT_SIGNED_INrTzNo auth state found for r)_clear_shared_nous_statelogoutzLogged out of z+Model provider configuration was unchanged.rz)Hermes will use OpenRouter for inference.z9Run `hermes model` or configure an API key to use Hermes.)rrrKrLr2rErrSrTr+rArrhermes_cli.auth_nousrTrHrr)rrnrrrSrTshould_reset_configrrTs& rlogout_commandrX s$ D1K1+>> ";-01m  [ [/1 [ [5Y5[F  34 P 1&9 : : ) * A&I26:M  ' '+> (q9: A *  N=/ +,  ;< ' ( ( 9: IJr)rr)z openai-apiz OpenAI APIzhttps://api.openai.com/v1)rOPENAI_BASE_URL)rz LM Studiozhttp://127.0.0.1:1234/v1) LM_API_KEY LM_BASE_URL)COPILOT_GITHUB_TOKENGH_TOKEN GITHUB_TOKEN)rzGoogle AI Studioz0https://generativelanguage.googleapis.com/v1beta)GOOGLE_API_KEYGEMINI_API_KEYGEMINI_BASE_URL)rz Z.AI / GLMzhttps://api.z.ai/api/paas/v4) GLM_API_KEY ZAI_API_KEY Z_AI_API_KEY GLM_BASE_URL)r zKimi / Moonshotzhttps://api.moonshot.ai/v1) KIMI_API_KEYKIMI_CODING_API_KEY KIMI_BASE_URL)r zKimi / Moonshot (China)zhttps://api.moonshot.cn/v1)KIMI_CN_API_KEY)STEPFUN_API_KEY)r zArcee AIzhttps://api.arcee.ai/api/v1)ARCEEAI_API_KEYARCEE_BASE_URL)rz GMI Cloudzhttps://api.gmi-serving.com/v1) GMI_API_KEY GMI_BASE_URL)ACTUAL_API_KEY)minimaxMiniMaxz https://api.minimax.io/anthropic)MINIMAX_API_KEYMINIMAX_BASE_URL)r Anthropiczhttps://api.anthropic.com)ANTHROPIC_API_KEYANTHROPIC_TOKENrANTHROPIC_BASE_URL)alibabaz Qwen Cloudz6https://dashscope-intl.aliyuncs.com/compatible-mode/v1)DASHSCOPE_API_KEYDASHSCOPE_BASE_URL)rzAlibaba Cloud (Coding Plan)z-https://coding-intl.dashscope.aliyuncs.com/v1)ALIBABA_CODING_PLAN_API_KEYryALIBABA_CODING_PLAN_BASE_URL)rzMiniMax (China)z"https://api.minimaxi.com/anthropic)MINIMAX_CN_API_KEYMINIMAX_CN_BASE_URL)deepseekDeepSeekzhttps://api.deepseek.com/v1)DEEPSEEK_API_KEYDEEPSEEK_BASE_URL)rxAIzhttps://api.x.ai/v1) XAI_API_KEY XAI_BASE_URL)nvidiaz NVIDIA NIMz#https://integrate.api.nvidia.com/v1)NVIDIA_API_KEYNVIDIA_BASE_URL)rzVercel AI Gatewayzhttps://ai-gateway.vercel.sh/v1)AI_GATEWAY_API_KEYAI_GATEWAY_BASE_URL)rz OpenCode Zenzhttps://opencode.ai/zen/v1)OPENCODE_ZEN_API_KEYOPENCODE_ZEN_BASE_URL)rz OpenCode Gozhttps://opencode.ai/zen/go/v1)OPENCODE_GO_API_KEYOPENCODE_GO_BASE_URL)rz Kilo Codezhttps://api.kilo.ai/api/gateway)KILOCODE_API_KEYKILOCODE_BASE_URL)r z Hugging Facez https://router.huggingface.co/v1)HF_TOKEN HF_BASE_URL)r!z Xiaomi MiMozhttps://api.xiaomimimo.com/v1)XIAOMI_API_KEYXIAOMI_BASE_URL)r"zTencent TokenHubz#https://tokenhub.tencentmaas.com/v1)TOKENHUB_API_KEYTOKENHUB_BASE_URL)r#zTencent TokenPlanz2https://api.lkeap.cloud.tencent.com/plan/anthropic)TOKENPLAN_API_KEYTOKENPLAN_BASE_URL)OLLAMA_API_KEY)r%z AWS Bedrockz/https://bedrock-runtime.us-east-1.amazonaws.comrBEDROCK_BASE_URLr&)vertexzGoogle Vertex AIrrrr)r'z Azure Foundryr)rAZURE_FOUNDRY_BASE_URL> *nonenulldummyexamplechangeme placeholder your_api_keyyour_api_key_here***** your-api-key)zsk-ghp_hf_)zsk-or->account_missingno_usable_creditssubscription_expiredmember_spend_cap_exceededr*)rrlast_error_codelast_error_reasonlast_error_messagelast_error_reset_atr)rrr\ expires_at_msr/ obtained_atr agent_keyagent_key_expires_atagent_key_expires_in agent_key_idagent_key_obtained_atagent_key_reusedrr>manual device_code hermes_pkce loopback_pkce)rz google-vertexz vertex-aiz gcp-vertexvertexai)rrr\r/r>rrportal.nousresearch.com> invalid_grant invalid_tokenrefresh_token_reused>rMr[r](__conditional_annotations__r __future__rpmrrrhloggingrrjrrrL webbrowser contextlibrr dataclassesrr functoolsrr r r pathlibr typingr rrrrrrr urllib.parserrrrragent.credential_persistencerutilsrrrrhermes_cli.auth_zai_kimirrr r!r"r#hermes_cli.auth_model_pickerr$r%hermes_cli.auth_device_flowr&r'r(r)r*r+r,r-r.r/r0r1r2r3hermes_cli.auth_oauth_grantsr4r5r6r7r8r9rVr:r;r<r=r>r?r@rArBrCrDrErFrGrHrIrJrKrLrMrNrOrPrQrRrSrTrUrVrWrXrYrZr[r\r]r^r_r`rahermes_cli.auth_minimaxrbrcrdrerfrgrhrirjrkrlrmrnhermes_cli.auth_xairorprqrrrsrtrurvrwrxryrzr{r|rr}r~rrrrrrrrrrrrrrrhermes_cli.auth_openrouterrhermes_cli.guest_handoffrhermes_cli.auth_qwenrrrrrrrhermes_cli.auth_constantsrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr getLoggerrr|rrrrrrrr(rrr/rBUILTIN_PROVIDER_IDSrEr0r1r2r3r4 hermes_cli.auth_plugin_providersr5r6rr7rHrhr[rcrjrlrrrwrrrrrrrrrrrrrLockrrrrrrEACCESEAGAINrrrr,r5r9rTrZr_rrxrrrrrrrrrrrrrrrrrrrrrrrrrr r$r(r+r.r2r7r;rVr\rdrnrrr_rjrZrurvr{rrrrrrrrrrrrrr rrrr%r+r-r1r4r6rIr7rbrCr@rurirrmrpryr|_OAUTH_GRANT_DEAD_CODES_NOUS_AUTH_MISSING_CODESrr_is_terminal_nous_refresh_error$_is_terminal_xai_oauth_refresh_error&_is_terminal_codex_oauth_refresh_errorrrrrrrrrrrrrr~rrrrr r%r+r1r;r>rArErHrMrrX)rQr+rDrs000@rrsE X#   0(,,RRR!TTMOO001(((( ** B B B B B B B B B B B//// eeee AAAAA>5&&&[[[[[[[[[[[   8 $@&     NNJ#b 2D[5AW "J#b >>3CXno J#b f J#b<>N57J#b</?TijJ#bZJ#b "@9;QSJ#b+-?7J`bJ#b">#J#b&E'J#b.?/J#b2f3J#b4#%DFZ\no5J#b6a7J#b8]9J#b: "9;NPab;J#b<i=J#b>4q44+1- L G$W&;@70vc!e%%BCGaa*:  ]D9;5:"+.."2  c _$$hllELL'%D2QR$hh0 I.  99x6 Y]  <--`TUTT  < bH 3Ljj"4uy44K ,EV[EE \)4  LL60!= ]#G ,0 #G ! #G#GL/dT)+/)37)9= ))X  %&A 6$5 1 aV<] 9:;"#\]Y F ( _*$":D!A&.1Mt0T*D1K3G3 ",%%,2%%2 5%%2%%%2!'%%207%%2 h%%2'%%23Ex%%2 E%%25%%2#)%%%2 %%2+K %%2 + %%2 0 %%2  M %%2 -m %%2 >H %%2%%2"/0@%%2 I%%2-i%%2%%2#G%%2%%2#E%%2x%%2"28%%2>CH%%2\%%2$0%%2o%%2(8%%2KZ[j%%2+%%2.>?T%%20%%2  k!%%2 )+!%%2" i#%%2"*9#%%2$Y%%%2$!/ %%%2&-'%%2&*=m'%%2()%%2( ()%%2(8KL)%%2*+%%2*!&~+%%2,<-%%2,",\-%%2, ?%%2>(?%%2>6A*?%%2@~A%%2@ /A%%2D XE%%2F hG%%2F'G%%2H HI%%2H!(I%%2JK%%2J'K%%2>%2P  22*0 u  ''\&y*&=>.[''+['(, [' ! ['['@@@  RR cc -SW--fXX.789.:N:&NN,5727  4! 4 $ 4 $ 4 !B 4 4M0M0l#X\U\GKCJ..##" $XXX2$$^_%&^_ 24J69QQfj l%;=T6:PRt9uu!"<>Y(*>@`)ab!#8:PR&DFeg62&II #**Dv"V'./IT_'`$)0*9& 0 0  ZZ _ _77, Y Y!!H``,\\"XX  &-7,@,F,F,HI,HyssNN,HI-75-7>7> , )74 (6n6..b77  &),  (^ Q JSFS++>4-"--`UUTT BB$ X X!K!KWI E FJ0z<Js0l,"l<$m m, l98l9< m m