+ jHj/Na0t$Rt^RIHt^RIt^RIHtHtHt]P!] 4t ] !0R&m4t R't]!4tR]R&RRltRR ltR R ltR R ltRRltRRltRRltRRltRRltRRltRRltRRltRRltR R!ltR"R#lt R$R%lt!R#)(uModel-provider plugins as first-class citizens of ``hermes auth`` and the credential pool. A ``plugins/model-providers//`` profile (``providers.base.ProviderProfile``) is mirrored into ``hermes_cli.auth.PROVIDER_REGISTRY`` with the ``auth_type`` it declares, so ``resolve_provider()`` accepts it whatever its auth shape. Non-api-key plugins own their login through two optional profile callables that core consults BEFORE any built-in, name-keyed path: - ``auth_handler(action, args) -> bool`` for ``hermes auth add|status|logout|refresh `` (``args`` is the parsed CLI namespace; truthy = the plugin owned the action, falsy = built-in path). - ``refresh_credential(entry) -> Mapping | None`` for the credential pool: given the pooled ``PooledCredential`` it returns the rotated fields (``access_token``, ``refresh_token``, ``expires_at_ms`` …) or raises. A separate hook rather than ``auth_handler("refresh", …)`` because the pool has a credential row, not an argparse namespace, and needs tokens back, not a bool. Every function here late-imports ``hermes_cli.auth`` names: this module is imported by the auth facade right after ``PROVIDER_REGISTRY`` exists, and by ``agent.credential_pool``. ) annotationsN)AnyCallableOptionalzset[str]PLUGIN_MIRRORED_PROVIDERSc V^8dQhRRRR/#)pprreturnztuple[tuple, str])formats"E/home/ubuntu/.hermes/hermes-agent/hermes_cli/auth_plugin_providers.py __annotate__r&sEECE$5EcaRo\;QJd!.V3RlVP4FNK 5M!V3RlVP44;'g VP\V3RlVP4R4;'gR3#)zXSplit a profile's ``env_vars`` into (api-key vars, base-URL var); the URL var may be "".cVVPR4;'gVPR4#) _BASE_URL_URL)endswith)vs&r %_api_key_env_fields..(s!qzz+.DD!**V2DDrc3H<"TFpS!V4'dKVxK R#5iNr .0ris_urls& r &_api_key_env_fields..)s:[q !![" "c3H<"TFpS!V4'gKVxK R#5irr rs& r rr*s6[F1I!![rN)tupleenv_varsnext)r rs&@r _api_key_env_fieldsr%&s` DF E:R[[:EE:R[[: : I Ibkk 6R[[6 = C C EErc V^8dQhRRRR/#)rr rr Noner )r s"r rr-s    rc"^RIHpHpHpVP\ 9dR#VP R8Xd]VP'gR#T!VPVP;'g VPVP.\V4O5!pMHT!VPVP;'g VPVP VPR7pWAVP&\PVP4\W@4R#)aMirror one profile into ``PROVIDER_REGISTRY`` under the ``auth_type`` it declares. Registering is what lets an out-of-tree provider pass ``resolve_provider()``'s known-provider gate ("Unknown provider"); OAuth-shaped plugins carry their own login via ``auth_handler``. )PROVIDER_REGISTRYProviderConfig_api_key_providerNapi_key)inference_base_url)hermes_cli.authr)r*r+name_REGISTRY_PLUGIN_SKIP auth_typer# display_namebase_urlr%raddmirror_aliases)r r)r*r+pconfigs& r register_plugin_providerr7-s UT ww'' ||y {{{ #BGGR__-G-GoWjkmWno "//*D*DRWWbllgigrgrs!(bgg!!"''*7rc$V^8dQhRRRRRR/#)rr raliasstrr boolr )r s"r rrBs&^^^S^T^rc^RIHpHpT!T4pTRJ;'d7TPTP8H;'dT!TP4R8H# \dR#i;i)zZTrue when *alias* resolves to the ``$HERMES_HOME`` plugin *pp* in the ``providers`` layer.)get_provider_profileprovider_sourceFNuser) providersr=r> Exceptionr/)r r9r=r>owners&& r _user_owns_aliasrCBsaC ! 'E   ] ]rww!6 ] ]?277;SW];]] sA A#"A#c$V^8dQhRRRRRR/#rr6rr r r'r )r s"r rrLs! / /C /S /T /rcr^RIHpVPF pW29g\W4'gKWV&K" R#)uPoint ``pp.aliases`` at *pconfig* so ``resolve_provider()`` resolves them too. A bundled plugin never steals an alias another row already holds; a ``$HERMES_HOME`` plugin whose alias the ``providers`` layer already resolves to it does — the same ownership rule as :func:`override_registry_row`, otherwise the alias kept resolving to the built-in row while ``providers.get_provider_profile`` followed the user's profile (#116668). r)N)r.r)aliasesrC)r6r r)r9s&& r r5r5Ls.2  )-=b-H-H'.e $rc$V^8dQhRRRRRR/#rEr )r s"r rr[s! / /3 /C /D /rcRVP'dVPVnVP'dVPVnVPRu;8XdVP8Xd>MR#VP 'd&\ V4wVnpV'd W nR#R#R#R#)uA ``$HERMES_HOME`` plugin re-registering a name that already has a row wins for the fields it declares — ``display_name``, ``base_url`` and, on api-key rows, ``env_vars`` (#48450, #116668). ``register_provider()`` is last-writer-wins for the profile; without this the runtime kept reading the built-in endpoint. In place, so alias rows sharing the object follow; idempotent, so re-sync is free. r,N) r2r/r3r-r1r#r%api_key_env_varsbase_url_env_var)r6r url_vars&& r override_registry_rowrN[sx    {{{%'[[" ||y5G$5$555"+++,?,C) ' '. $ ;F5rcV^8dQhRR/#)rr intr )r s"r rrkssrc^RIHpHp^RIHpHpV!4p^pTFpTPT9dTPT9;'gTP\9pT'deTP\9dPT!TP4R8Xd9\YP,T4\YP,T4K\T4YVPT9, pK T# \ d^#i;i)uMirror provider-plugin profiles into ``PROVIDER_REGISTRY``; return how many were added. Idempotent (existing entries are never replaced — a user plugin re-registering a bundled name only rewrites the fields it declares, see :func:`override_registry_row`), so it is safe from resolution paths. It runs at auth import and again whenever a name is missing (:func:`registry_lookup`) or when ``providers`` finishes discovery, because the import-time pass can observe a *partial* profile list: a plugin whose own imports pull ``hermes_cli.auth`` in mid-``_discover_providers()`` sees only what was registered so far, and every later plugin would otherwise fail with "Unknown provider" (#102123). )BUILTIN_PROVIDER_IDSr))list_providersr>r?) r.rRr)r@rSr>rAr/rr0rNr5r7)rRr)rSr>profilesaddedr core_rows r sync_plugin_provider_registryrWksH=!# E 77' 'ww"66^^"''E^:^HBGG+@@_UWU\U\E]agEg%&7&@"E092>  $ --- L sC// C>=C>c V^8dQhRRRR/#)r provider_idr:r Optional[Any]r )r s"r rrsrc~^RIHpVPV4pVf"\4'dVPV4pV#)zB``PROVIDER_REGISTRY.get`` that re-syncs plugin profiles on a miss.rG)r.r)getrW)rYr)r6s& r registry_lookupr]s81##K0G8::#'' 4 Nrc V^8dQhRRRR/#)rproviderr:r rZr )r s"r rrs**S*]*rcD^RIHpT!T4# \dR#i;i)z`The registered ``ProviderProfile`` for *provider*, or None (also when the layer is unavailable).)r=N)r@r=rA)r_r=s& r plugin_profileras+2  )) s  c$V^8dQhRRRRRR/#)rr_r:r/r zOptional[Callable[..., Any]]r )r s"r rrs",,C,s,/K,rcX\\V4VR4p\V4'dV#R#r)getattrracallable)r_r/hooks&& r _profile_hookrgs( >(+T4 8DD>>4+t+rc V^8dQhRRRR/#)rr_r:r z#Optional[Callable[[str, Any], Any]]r )r s"r rrs33#3*M3rc\VR4#) auth_handlerrgr_s&r plugin_auth_handlerrms > 22rc V^8dQhRRRR/#)rr_r:r zOptional[Callable[[Any], Any]]r )r s"r rrs99#9*H9rc\VR4#)z^The profile's ``refresh_credential`` hook, i.e. whether its pooled OAuth rows are refreshable.refresh_credentialrkrls&r plugin_refresh_hookrqs #7 88rc V^8dQhRRRR/#)rr_r:r r;r )r s"r rrs``C`D`rc@^RIHpW9;'g\V4RJ#)zMBuilt-in refreshable set OR a plugin profile shipping ``refresh_credential``.)REFRESHABLE_OAUTH_PROVIDERSN)agent.credential_poolrtrq)r_rts& r is_refreshable_oauth_providerrvs"A  2 _ _6I(6S[_6__rc(V^8dQhRRRRRRRR/#)ractionr:argsrr_r r;r )r s"r rrs.qqqCq3q4qrc ^RIHpV!WV4pVeV#\V4pVfR#\V!W44# \dh\ d0p\ T RT R\ T4P RT 24ThRp?ii;i)alOffer ``hermes auth `` to the provider's ``auth_handler``. True = the plugin owned the action (core prints nothing more). False = run the built-in path. A handler exception becomes a readable ``SystemExit`` naming provider and action. ``:`` names an OAuth client a plugin declares under ``oauth:`` (:mod:`hermes_cli.plugin_oauth`). )handle_auth_actionNFz auth handler failed for `z`: z: )hermes_cli.plugin_oauthr{rmr; SystemExitrAtype__name__)rxryr_r{ownedhandlerexcs&&& r dispatch_plugin_authrs; vX 6E  !(+GqGF)**  qH:%?xs4PS9K]K]J^^`ad`efgmppqs9A>A>*A99A>c$V^8dQhRRRRRR/#)rr_r:rxr zOptional[SystemExit]r )r s"r rrs'YYYSYEYYrc V\9dR#\V4pVeVPR8Xg\V4eR#\ RV RVP RV RV R2 4#)aFail loud for a registered non-api-key plugin that ships no ``auth_handler``. Its login is not something core can perform (there is no token endpoint to call), and silently running the api-key prompt or reporting "Unknown provider" both hide the plugin bug. Nr,z Provider 'z' declares auth_type 'z8' but its plugin ships no auth_handler, so `hermes auth  zf` cannot be handled. Add `auth_handler=` to its ProviderProfile (see the model-provider plugin guide).)rrar1rmr})r_rxprofiles&& r !plugin_missing_auth_handler_errorrs| 00X&G'++y8.sO.@JJ*!**.@s..hintzRun `hermes auth add z ` to sign in.) rrurentries access_token agent_keystriprrq refresh_tokenr;lenr$)rYrrrlive refreshables& r get_plugin_oauth_auth_statusrs*33U##/#K088:l:Q~~?b?bQRQ\Q\?b?b`b>i>i>kqq:Gl =w!&9!&D>D>;EE>zaicustomcopilot openrouter kimi-codingkimi-coding-cn)r4statuslogoutrefresh)"__conditional_annotations____doc__ __future__rloggingtypingrrr getLoggerrlogger frozensetr0PLUGIN_AUTH_ACTIONSsetr__annotations__r%r7rCr5rNrWr]rargrmrqrvrrrr)rs@r rs"#**   8 $ ""mn< '*e8+E *^ / / B*, 39 `q.Y" Tr