+ jHjogaR\t20tRt^RIt^RIt^RIHtHtHtHtH t H t ^RI H t ^RI Ht]P!R4t]!4t]^kRRltRR R R R R R R R R RRRRRRRRRRRRRRRR/ t]!0R]m4t]!0R^m4tRRltRRltRRltRR ltR!R"R#R$R%R&R'R(R)R(R*R+R,R-R.R/R0R1/ t]^k0R_mtR2R3ltR4R5ltR6R7/R8R9llt R6R7/R:R;llt!R<R=lt"R`R>R?llt#R@RAlt$RaRBRCllt%RDRElt&RFRGlt'RHRIlt(RaRJRKllt)RaRLRMllt*RNROlt+RaRPRQllt,RaRRRSllt-RaRTRUllt.RaRVRWllt/RaRXRYllt0RZR[lt1R#)baCustom-provider entry normalization and per-route lookups (TLS, headers, context length, capabilities). Split out of ``hermes_cli/config.py``; every name is re-imported there, so ``hermes_cli.config.`` keeps resolving (and monkeypatching) as before. Functions that call ``get_compatible_custom_providers`` / ``load_config*`` import them lazily from ``hermes_cli.config`` so tests patching that module still intercept the call. N)AnyDictIteratorListOptionalTuple)urlparse)normalize_route_base_urlzhermes_cli.configc LV^8dQhR\R\R\R\RR/#) provider_key signaturemsgargsreturnNstrr)formats"@/home/ubuntu/.hermes/hermes-agent/hermes_cli/config_providers.py __annotate__rs1##CPSX\cT;'gRV3pV\9dR#\PV4\P!V.VO5!R#)zKEmit ``logger.warning(msg, *args)`` at most once per (provider, signature).?N)_PROVIDER_NORMALIZE_WARNEDaddloggerwarning)r r rr dedup_keys&&&* r_warn_once_per_providerrs?$$i0I..""9- NN3ropenaichat_completions openai_chatz openai-chatzchat-completionschatcompletions responsescodex_responsesopenai_responseszopenai-responses anthropicanthropic_messageszanthropic-messagesmessagesbedrockbedrock_conversezbedrock-conversec0V^8dQhR\R\/#)r api_moderr)rs"rrr<s;;#;#;rcjVP4p\PVP4V4#)zUMap alias ``api_mode`` spellings to canonical transport names (unknown pass through).)strip_API_MODE_ALIASESgetlower)r,cleaneds& r_canonical_api_moder4<s'nnG  ' ::rc0V^8dQhR\R\/#r valuer)rr)rs"rrrBsccrc@VfR#\V4P4#)z%Provider identity fields are strings.)rr/)r7s&rcoerce_provider_idr:Bs } u:   rc0V^8dQhR\R\/#)r providersr)rdict)rs"rrrIs  c d rc\V\4'g/#/pVP4Fwr#\V4pV'gKW1V&K V#)zYCopy a ``providers:`` mapping so keys are strings (unquoted YAML ``2070:`` loads as int).) isinstancer=itemsr:)r<outstoredr7keys& rstringify_provider_maprDIsI i & & C"*  ( 3H+ Jrc V^8dQhR\R\R\\\\\\3,,3,/#)r r<rCr)rtuplerr=r)rs"rrrUs9  3 S U3cSVh@X;X5Y rc@\V\4'gR#\V4pV'gR#VPV4p\V\4'dW#3#VP 4F2wrE\V4V8XgK\V\4'gK/WE3u# R#)zXReturn ``(stored_key, entry)`` matching *key* by string identity (exact hit, then scan).NN)r?r=r:r1r@)r<rCwantexactrBentrys&& rfind_provider_entryrLUs i & & c "D  MM$ E%{"*  f % -*UD2I2I= + rapiKeyapi_keybaseUrlbase_urlapiModer,keyEnvkey_env apiKeyEnv defaultModel default_model contextLengthcontext_lengthrateLimitDelayrate_limit_delaysessionAffinityHeadersession_affinity_headerc^V^8dQhR\\\3,R\R\/#r rKr rr=rr)rs"rrr}s)4S>rcRFpVPV4p\V\4'dVP4'gKBVP4p\P !RV4'dVu#\ V4pV'd)VP'dVP'dVu#\PRT;'gRW$4K R# \dRpLfi;i)zFirst usable URL among ``base_url``/``url``/``api``, or "". URLs with unresolved ``${ENV_VAR}`` / ``{region}`` placeholders are accepted unvalidated: they expand at runtime, and rejecting them here would silently drop the provider. z \{[^}]+\}NuPproviders.%s: '%s' value '%s' is not a valid URL (no scheme or host) — skippedrr9)rPurlapi) r1r?rr/researchr ValueErrorschemenetlocrr)rKr url_keyraw_url candidateparseds&& r_pick_provider_base_urlrl}s .))G$7C((W]]__ MMO 99\9 - -  i(F fmmm   .   C 5#.*  F s7 C C)(C)ctV^8dQhR\R\\\\3,\3,/#)r modelsr)rrFr=rbool)rs"rrrs,suT#s(^T5I/JrcHRp\V\4'dAV'd9\V4pVPRR4RJdRpVPRR4W!3#\V\4'Ed+V'Ed"/pVEFp\V\4'd+VP 4'd/W4P 4&KD\V\4'gK\VP R4p\V\4'dVP 4'gVP R4p\V\4'dVP 4'gKVP4UUu/uFwrgVR9gKWgbK uppW5P 4&EK W13#/V3#uuppi) zNormalize an entry's ``models`` to ``(models_dict, discovered_flag)``. The legacy in-mapping ``__discovered_model_catalog__`` sentinel is accepted and stripped; a plain list of ids or ``[{id: ...}]`` rows is converted so /model doesn't show (0) models. F__discovered_model_catalog__NT__explicit_model_allowlist__idname>rsrt)r?r=poplistrr/r1r@)rn discovered models_copynormalized_modelsitemmodel_idkvs& r_normalize_provider_modelsr~sR J&$F6l ??94 @D HJ6=&&&$FF,.D$$$24!**,/dD))xx~Hh,,HNN4D4D88F+h,,HNN4D4D!%3J!-.1H3J nn. /!,, z>3Js ( F8Fr r9c tV^8dQhR\R\R\\\\3,,/#r^rrrr=)rs"rrrs6]] ]!$].6tCH~.F]rc aa\S\4'gR#\S4o\V4pRS9dRS9d SR,SR&\P 4F?wr#VS9gKVS9gK\ TRV 2RT;'gRW#4SV,SV&KA \ SP44\, \ \P44, pV'dQ\ TRRP\V44,R T;'gRR P\V444\SV4p\SPR 44;'gTpV'd V'gR#R VR V/oV'dVSR &RV3RllpRV3RllpV!RV!R44V!RV!R44V!RR4p V!RV 4V 'd4SPR4'dSPR4'gV SR&V!RR4p T!RV 'd \V 4MR4V!RV!RR44V!RV!R44\SPR44wrV!RV 4SPR4RJg V 'dRSR&SPR4p \V \4'd\T!RV P 4UUu/uF7wr\V\4'gK\V\ 4'gK5WbK9 upp4RR3R R!3R"R#33F1wppV!SPV44'gK%SV,SV&K3 \SPR$4\4'd\SR$,4SR$&V!R%\#SPR%444V!R&V!R&44V!R'V!R'44SPR(4p\V\ 4'dVSR(&S#\V\4'd*VP%4'dVP%4SR(&S#uuppi))z>Return a runtime-compatible custom provider entry or ``None``.N api_key_envrSzcamel:z[providers.%s: camelCase key '%s' auto-mapped to '%s' (use snake_case to avoid this warning)rzunknown:,z-providers.%s: unknown config keys ignored: %sz, rtrPr c0V^8dQhR\R\/#)r keysrr-)rs"rr6_normalize_custom_provider_entry..__annotate__s;;;;rc<RpVFpSPV4pV'gKM \V\4'dVP4#R#)Nr9)r1r?rr/)rvalr|rKs* r _stripped3_normalize_custom_provider_entry.._strippedsFA))A,Cs)c22syy{::rc4V^8dQhR\R\RR/#)r fieldr7rNr)rs"rrrs!&&C&&&rc&<V'dVSV&R#R#N)rr7 normalizeds&&r_put._normalize_custom_provider_entry.._puts  %Ju  rrNkey_cmdr, transportr9modelrVcatalog_providerrnmodels_discoveredT capabilitiesrXc<\V\4;'dV^8#)r?intr}s&r2_normalize_custom_provider_entry..sZ3%7%A%AAE%ArrZcH\V\\34;'dV^8#r)r?rfloatrs&rrrsz!c5\'B'M'MqAv'Mrdiscover_modelsc.\V\\34#r)r?rorrs&rrrsjT3K&@r extra_body extra_headersr\ ssl_ca_cert ssl_verify)r?r=r:_CAMEL_ALIASESr@rsetr_KNOWN_PROVIDER_KEYSjoinsortedrlr1r4r~rronormalize_extra_headersr/)rKr camelsnakeunknownrPrtrrrSr, models_dictrwrrCr7rokrrsf$ @r _normalize_custom_provider_entryrs eT " " KE%l3L)5"8 /i&,,.  E>e50 #ug.9##U  3 !";;&& Ii()Ii() =1GG599]++EIIi4H4H$+ =![1Hh(2BG)G_56 Y'9:;989LMK; yy$%-*. &'99^,L,%% ^)5););)=A)=:3#s# (25$(? CJ)=A B AB MN @A r eii   %e Ju  %))L)400#'l(;#< <  1%))O2LMN "I.G$HI -01<(J*d###- <   J $ $)9)9););#-#3#3#5 < 3AsQ 9Q Q c tV^8dQhR\R\R\\\\3,,/#r^r)rs"rrrs1 !$.6tCH~.Frc\WR7pVfR#RVR,/pR FpWB9gK W$,W4&K RV9d VR,VR&RV9d VR,VR&V#) zDTranslate a legacy custom provider entry to the v12 providers shape.r NrbrPrrVr,r)rtrNrSrrnrrXrZrrrr\rrr)r)rKr rprovider_entryrs&$ r)_custom_provider_entry_to_provider_configrs}2%SJ&+Z -C%DNT  $.$5N ! T **4W*='Z&0&<{# rchV^8dQhR\R\\\\3,,/#)r providers_dictr)rrvr=r)rs"rrr2s'  s tDcN?S rc\V\4'g.#.pVP4F[wr#\V\4'd\V4'gK.\ V\ V4R7pVfKJVP V4K] V#)zUNormalize enabled ``providers`` config entries into the legacy custom-provider shape.r)r?r=r@is_provider_enabledrr:append)rcustom_providersrCrKrs& r"providers_dict_to_custom_providersr2sy nd + + -/$**,  eT " "+>u+E+E 5eJ\]`Jab  !  # #J / - rcV^8dQhR\\\\3,,R\\\\3,,/#)r configr)rr=rrrv)rs"rrr@s6-- T#s(^ $-04T#s(^0D-rc^RIHpVfV!4pVPR4pVeB\V\4'g,\ P R\V4P4.pT;'g.Uu.uFp\V4NK ppV\VPR44, pRRlp.p\4p\4pVFp V fK V!V R4p V!V R4p \V PR R 4;'gR 4P4PR 4P4p WV!V R 43p V 'd W9dKV 'dV 'd W9dKVP!V 4V 'dVP#V 4V 'gKV 'gKVP#V 4K V#uupi) zDeduplicated list view over legacy ``custom_providers`` and v12+ ``providers``. Never materialised back into config.yaml (it would duplicate entries in UIs). ) load_configrucustom_providers is a %s, expected a list — skipping legacy entries; 'providers:' entries are still used. Move provider configs to the 'providers:' section.r<c^V^8dQhR\\\3,R\R\/#)r rKrrr_)rs"rr5get_compatible_custom_providers..__annotate__Ws)??T#s(^?C?C?rc\VPVR4;'gR4P4P4#)r9)rr1r/r2)rKrs&&r_norm.get_compatible_custom_providers.._normWs2599UB'--2.446<<>>rr rtrPr9/r)hermes_cli.configrr1r?rvrrtype__name__rrrrr/rstripr2rr)rrre candidatesr compatibleseen_provider_keysseen_name_url_pairsrKr rtrPpairs& rget_compatible_custom_providersr@s . ~zz"45#J7G,N,N  f ! " + + -@P@V@VTV@VX@V!215@VJX4VZZ 5LMMJ?(*J!e"u = UN3 UF#uyyR066B7==?FFsKQQSeW 56 L>  H!< %   " "< 0 4HH  # #D ) 3Ys6F>c V^8dQhR\R\\\\\3,,,R\\\\3,,/#)r rPrrrrrvr=r)rs"rrrpsEtDcN34 T#s(^ $rc#f"^RIHpVf V!V4pV'd\V\4'gR#\ V4pV'gR#VFKp\V\ 4'gK\ VPR44pV'gK?Wd8XgKGVxKM R# \d.pLi;i5i)uYield entries whose normalized route identity equals *base_url*. None *custom_providers* → ``get_compatible_custom_providers(config)`` (failure → none). )rNrP)rr Exceptionr?rvr r=r1)rPrrr target_urlrK entry_urls&&& r_entries_for_routerpsB ">vF  :&6==)(3J !%&& ,UYYz-BC 90K " "!  "s9 B1BB1A)B1 B1 B1 B.+B1-B..B1c V^8dQhR\R\\\\\3,,,R\\\\3,,R\/#r rPrrrr)rs"rrrsOtDcN34 T#s(^ $ rc\WV4FZpRFQpVPV4p\V\4'gK,VP 4'gKD\ V4uu# K\ R#)a>Canonical ``api_mode`` of the first custom entry serving *base_url*, or ``""``. Route identity is the URL, not the host: a Codex proxy on ``127.0.0.1`` declares its wire protocol here and nowhere else, so metadata lookups keyed on the transport read it from the entry instead of guessing from the hostname (#116191). r9)r,r)rr1r?rr/r4)rPrrrKrr7s&&& rget_custom_provider_api_modersU$HG.EIIe$E%%%%++--*511/H rc V^8dQhR\\\3,R\R\\\\3,,/#)r rKrr)r=rrr)rs"rrrs6>>DcN>3>8DcN;S>rcVPR4p\V\4'gR#VPV4p\V\4'dV#R#)zAReturn ``entry.models[model]`` when both are mappings, else None.rnN)r1r?r=)rKrrn model_cfgs&& r_route_model_cfgrsE YYx F fd # # 5!I"9d339==rc V^8dQhR\R\R\\\\\3,,,R\\\\3,,R\ \\\3,,/#r rrPrrr)rrrvr=rr)rs"rrrsf     tDcN34  T#s(^ $ *2$sCx.)A rc#^"\WV4Fp\W@4pVfKVxK R#5i)zHYield the ``models.`` mapping of every entry matching *base_url*.N)rr)rrPrrrKrs&&&& r_route_model_cfgsrs. $HG$U2  OHs- -cFV^8dQhR\R\\,/#r6)rrro)rs"rrrschtnrcVfR#\V\4'dV#\V\4'd;VP4P 4pV\ 9dR#V\ 9dR#R#R#)NFT)r?rorr/r2 _FALSE_WORDS _TRUE_WORDS)r7lowereds& r_coerce_ssl_verifyrs_ }% %++-%%'</u]W =ST]Y]] rc V^8dQhR\R\\\\\3,,,R\\\\3,,R\\\3,/#rr)rs"rrrsWtDcN34 T#s(^ $15S#Xrc\WV4Fyp/pVPR4p\V\4'd*VP 4'dVP 4VR&\ VPR44pVeWdR&Vu# /#)zOReturn TLS settings from a matching ``custom_providers`` / ``providers`` entry.rr)rr1r?rr/r)rPrrrKrAcaverifys&&& r get_custom_provider_tls_settingsrs} $HG  YY} % b#  288::!#C #EIIl$;<   &  H Irc V^8dQhR\\\3,R\R\\\\\3,,,R\\\\3,,RR/#r client_kwargsrPrrrNr=rrrrv)rs"rrrsa 8 8S> 8 8tDcN34 8 T#s(^ $ 815 8rc\WV4pVPR4'd VR,VR&RV9dVR,VR&R#R#)zCAttach per-provider TLS knobs to OpenAI client kwargs when matched.rrN)rr1)rrPrrtlss&&&& r*apply_custom_provider_tls_to_client_kwargsrsJ +8v NC ww}'*='9 m$s&),&7 l#rcRV^8dQhR\R\\\3,/#)r rr)rr=r)rs"rrrs&OO3O4S>Orc\V\4'd V'g/#VP4UUu/uF wrVfK \V4\V4bK" upp#uuppi)zNormalize a raw ``extra_headers`` value into a ``dict[str, str]``. SECURITY: header values routinely carry credentials (Cloudflare Access service tokens, proxy auth, custom bearer schemes). Callers must never log the returned values. )r?r=r@r)rr|r}s& rrrsM mT * *- '4':':'< N' . .tDcN34 . T#s(^ $ .15 .rc\WV4pV'gR#\VPR4;'g/4pVPV4WPR&R#)zMerge per-provider ``extra_headers`` onto OpenAI client ``default_headers`` (provider wins over SDK defaults, most specific level). SECURITY: values may carry credentials; never log.Ndefault_headers)rr=r1update)rrPrrrmergeds&&&& r4apply_custom_provider_extra_headers_to_client_kwargsrsJ6hRXYM  -##$56<<" =F MM- '-#$rc V^8dQhR\R\\\\\3,,,R\\\\3,,R\/#rr)rs"rrrsO   tDcN34  T#s(^ $ 14 rc\WV4FTpVPR4p\V\4'gK,VP 4'gKDVP 4u# R#)zHeader NAME declared as ``session_affinity_header`` on the route-matching entry, else "". Opt-in per provider (default off): Hermes never ships a session identifier to an endpoint that did not ask for one (#86241). r\r9)rr1r?rr/)rPrrrKheaders&&& r+get_custom_provider_session_affinity_headerr sM$HG45 fc " "v||~~<<> !H rc V^8dQhR\R\R\\\\\3,,,R\\\\3,,R\\ ,/#r)rrrvr=rr)rs"rrrs]** **tDcN34* T#s(^ $ *19 *rc^RIHpHpV'd V'gR#VfT!VfV!4MT4pRRlp\WW#4F"pV!VP R44p V fK V u# \WV4F"p V!V P R44p V fK V u# R# \d6TfR#TP R4p\ T\ 4'dTM.pLi;i)aPer-model ``context_length`` override from a route-matching entry, or ``None``. Before this helper existed, the lookup was duplicated in ``run_agent.py``'s startup path only; every other path (notably ``/model`` switch) fell back to the 128K default. See #15779. rload_config_readonlyNrcFV^8dQhR\R\\,/#)r rawr)rrr)rs"rr8get_custom_provider_context_length..__annotate__+s((3(8C=(rc`\V4pT^8dT#R# \\3dR#i;ir)r TypeErrorre)rctxs& r _positive_int9get_custom_provider_context_length.._positive_int+s< c(CAgs'4':&  s --rX) rrr rr1r?rvrr) rrPrrrr rrrrrKs &&&& r"get_custom_provider_context_lengthrsX  D ?Y_Yg?S?Umst ('u8HQ IMM*:;< ?JR$HGEII&678 ?JH 1 D~**/0C&0d&;&;s   DsBC1+CCc V^8dQhR\R\R\R\\\\\3,,,R\\\\3,,R\\ ,/#)r rrP capabilityrrr)rrrvr=rro)rs"rrr@sg tDcN34  T#s(^ $  19 rc^RIHpHpV'dV'd V'gR#VfVfV!4pV!V4p\ WW44F.pVP V4p\ V\4'gK,Vu# R# \dR#i;i)zExplicit boolean capability for one custom-provider model, or ``None``. Scoped to the normalized route + exact runtime model id so aliases can declare capabilities.r N)rrr rrr1r?ro) rrPrrrrr rr7s &&&&& r$get_custom_provider_model_capabilityr@sX   ~./>vF 'u8HQ  j) eT " "LR   sA;; B  B chV^8dQhR\\\\3,,R\/#)r provider_cfgr)rr=rrro)rs"rrr\s'  htCH~&> 4 rc\V\4'gR#VPRR4p\V\4'dV#\V\4'd&VP 4P 4\9#\V4#)zWhether a ``providers.`` block is enabled: default True; only an explicit ``enabled: false`` hides it from the picker, ``/models``, runtime resolver and doctor.Tenabled)r?r=r1rorr/r2r)rflags& rrr\si lD ) )   It ,D$ $zz|!!#<77 :rcV^8dQh/^\9d \;R&^\9d\\\3,;R&#)r rr)__conditional_annotations__rr=r)rs"rrrs>.('C'/J 8 8S#X 8Kr>0noofffalse>1onyestrue>rbrartrrnrNrrSr,rPproviderrrrrrrrVrrXrrrZrstale_timeout_secondsrequest_timeout_secondsr\rrH)3r!__doc__loggingrctypingrrrrrr urllib.parserhermes_cli.route_identityr getLoggerrrrrr0 frozensetrrr4r:rDrLrrrlr~rrrrrrrrrrrrrrr rrrr)r!s@rr4s ==!>   . /#&%'  %%*)"))%.$ !*, 45 23 ;   $ i z z iO%(6 "8 83<D]')]@')* -`6&> " 8O  .  *Z8 r