+ lHjp Rt^RIHt^RIt^RIt^RIHtHt]!4tR5t RRlt RRlt RR /R R llt R R lt ]PRR /RRll4tRRltRRltRRltRRltRRltRRltRRltR6RRlltR R!ltR"tR#R$R%R R&RR'RR(R /R)R*lltR+R,ltR-R.ltR/R0ltR6R1R2lltR3R4ltR#)7zModel switching for a live session: persist, snapshot/restore runtime, /model apply with guards, bot-capability + config sync. Bodies are rebound onto server.py's globals at install time (method_ctx.bind_module), so they reference server.py globals bare.) annotationsN)HandlerRegistry bind_modulecV^8dQhRR/#)returndict)formats"=/home/ubuntu/.hermes/hermes-agent/tui_gateway/model_switch.py __annotate__r sXXDXc /\Uu/uFq\WR4bK upCR\P!\VRR44R\P!\VRR44/C#uupi)z?Capture the current agent model runtime for a one-turn restore.reasoning_configNprimary_runtime_primary_runtime) _RUNTIME_KEYSgetattrcopydeepcopy)agentks& r _snapshot_agent_model_runtimersj X?A'%B''? X  ge=OQU.V W t}}WU/_restore_agent_model_runtime...s"7cUbPQ Q8K8KUbs" capabilities new_model new_providerapi_keybase_urlapi_moder()rr$hasattrrrr_fallback_activated_rate_limited_untilr Exceptionloggerdebugrr!)rrprimarymodelproviderr,r-r.s&f r _restore_agent_model_runtimer8s' u}X%!)*D D "D21D2hydrate_secretsTc V^8dQhRRRR/#)rr9boolr _TurnScopesr )r s"r r r 6s77D7T_7r c<^RIHp\4pV'dI\V4pV'd^RIHpV!V4\ V4pRp\\V44Vn MY^RI H pH p \4pV!V4p\V4VnV!4'gV#\\V44Vn V !4pVPf%\Y`'d \V4MRR7Vn^RIHp V !WGR7VnV# \&d\)T4hi;i)uBind HERMES_HOME + secret + terminal scope for ``profile_home`` (None = launch profile) and return the reset tokens. The launch profile's SECRET scope is always bound — its ``.env`` over the launch env (live while single-profile, frozen at activation afterwards; never live ``os.environ`` once a secondary context may have written to it, #107422) — so the credential source is fixed at entry and an in-flight launch body survives a concurrent first-secondary activation instead of hitting ``UnscopedSecretError`` mid-request. Its terminal policy is bound only once multiplexing is active: single-profile terminal execution keeps the standalone ``os.environ`` bridge. ``hydrate_secrets=False`` skips resolving the profile's EXTERNAL secret sources (``op run``, ``bws``, ``sh -c`` — a subprocess with a 30s CLI budget holding a process-global lock). Pass it from any body that persists state rather than calls a provider: the exit-flush worker has a 5s TOTAL budget, and one slow source there costs the transcript the flush exists to save. )is_multiplex_active)hydrate_profile_secret_sourcesN)launch_secret_scopelaunch_terminal_env) profile_home)install_profile_terminal_scope) env_overlay)agent.secret_scoper>r<Pathhermes_cli.env_loaderr?build_profile_secret_scopeset_hermes_home_overridestrhome!tui_gateway.launch_profile_policyr@rA _launch_homeset_secret_scopesecrettools.terminal_scoperCterminalr2%_release_profile_runtime_scope_tokens) rBr9r>scopesrKr?secretsoverlayr@rArCs &$ r _profile_runtime_scope_tokensrV6s7 ]F&  %DP.t406GG23t9=FK c>D)$/G-W5FM&(( 23t9=FK)+G == ,WP\3t9bfgFM H8S  .f5 sBDA'DDc V^8dQhRRRR/#)rrSz_TurnScopes | Nonerrr )r s"r r r ps2Dr c VfR#^RIHpRpVPV3VP\3VP \ 33Fwr4VfK V!V4K VeVhR# \dpT;'gTpRp?K=Rp?ii;i)u4Release terminal → secret → home. Each reset is independent: a failing terminal reset must not leave the previous profile's secrets / HERMES_HOME installed for the next body in this context (a fail-open scope leak on the teardown path). The first failure is re-raised after every scope has been released.N)reset_terminal_scope)rPrYrQrOreset_secret_scoperKreset_hermes_home_overrider2)rSrY first_errortokenresetexcs& r rRrRps ~9(,K //+?@6==RdBe ++'ABD  =  - %L D -%,,K -s A  B+ A==Bc V^8dQhRRRR/#)rsessionrr9r;r )r s"r r r s66D6d6r c#"\VPR4VR7pRx\V4R# \T4i;i5i)zBind model resolution to the session's profile config and secrets (launch profile included once the process multiplexes; see ``_profile_runtime_scope_tokens``).rBr9N)rVr$rR)rar9rSs&$ r _session_profile_runtime_scoperds6+7;;~+FXg hF6 -f5-f5sA1 A >Ac V^8dQhRRRR/#)rrarrztuple[str, str]r )r s"r r r s $ $D $_ $r c,^RIHpHp\RVP R4;'gR/RR7;_uu_4\ 4^,'gV!4'dVR3uuRRR4#\ 4R3uuRRR4# +'giR#;i)a``(model, provider)`` a not-yet-built session of its OWN profile will run on. Bare ``_resolve_startup_runtime()`` reads the LAUNCH profile's config, so a secondary session's reply or first state.db row carried the launch profile's model id. On the Nous free tier the agent build pins ``nous/welcome`` (``pin_model_for_route``), so the configured default (often the silent default, with no provider) is not what the session runs; report the pinned route instead.) GUEST_MODELfree_tier_routerBNFrcnousr)hermes_cli.anon_authrgrhrdr$_resolve_startup_runtime_resolve_model)rargrhs& r _session_default_routerms{ B '^9T9\9\X\(]8= ? ?')!,,1B1B& ? ? #  ? ? ? ?s$BB, B B c$V^8dQhRRRRRR/#)rraroverriderr )r s"r r r s&LLdLdLtLr cV'd#VPR4VPR43M \V4wr#RV/V'dRV/C#/C#)z``session.info``'s model and provider for a not-yet-built session: the client's sticky pick when it sent one (so the client does not clobber it), else the profile's default route.r6r7)r$rm)raror6r7s&& r _lazy_info_routerqsNLTx||G,hll:.FGYopwYxOE U K H5 KKr KKr c(V^8dQhRRRRRRRR/#) rsidrJrar failed_readyzthreading.Event | Nonerr;r )r s"r r r s*sTQglpr cVfR#VPR\P44;_uu_4VPR4f?VPR4e,VPR4VJgVP 4'g RRR4R#VPR4pVPR4p\ V\ 4'dS\ V\ 4'd=/VCRV/CpVPR 4;p'dWTR &MVPR R4WAR&RVR&\P4VR&VPR R4VPR R4RRR4\W4R # +'giL;i)zBReplace one completed failed build generation and start its retry.NFagent_build_lockr agent_error agent_readymodel_overrideresume_runtime_overridesr7provider_overrideagent_build_started_agent_build_threadT) setdefault threadingLockr$is_set isinstancerpopEvent_start_agent_build)rsrartryresume_overridesr7s&&& r %_restart_completed_failed_agent_buildrsL   . 0@ A A KK , M0J0R;;}-\AI\I\I^I^ B A!%56";;'AB nd + + ;KT0R0RU"2U4DnU )--j99x98@!45 $$%8$?2B. /!% !*!2  )40 )40! B"s$ % B As AE/E/A.E/?AE// E? c V^8dQhRRRR/#)r raw_inputrJrz tuple[str, str, bool, bool, str]r )r s"r r r sppspGgpr c ^RIHpHpHpHpVf V!V4MTpVP VP VPVPVP3wrrp \VRR4Fp \WM,4h V 'dV 'd\WC,4hVf V!WWR7pV'g \R4hYY\VRR4;'gR3#)uhNormalize /model flags → (model_input, explicit_provider, one_turn, persist_global, reasoning_effort).)!MODEL_SWITCH_ERR_ONCE_WITH_GLOBALMODEL_SWITCH_ERROR_TEXTparse_model_switch_argsresolve_persist_behaviorerrors)is_onceexplicit_providerzmodel value requiredreasoning_effortrr ) hermes_cli.model_switchrrrr model_inputr is_global is_sessionrr ValueError)r parsed_flagspersist_overriderrrrfrris_global_flagrone_turncodes&&& r _switch_requestrs""/;.B * A q**AKKqyyLRHKN8R(0677)(0STT3 _ /00 8wqRdfhGiGoGomo oor c V^8dQhRRRR/#)rrrJrtupler )r s"r r r sPPSPUPr c.aS'd3\;QJd.V3RlR 4FNK 5#!V3RlR 44#\4pV'dVP4VRR3#^RIHpT!RT;'gRR7pVP RR4p\ V4'd\V\4'd\T;'gR4p\VP RR4;'gR4pYb\VP RR4;'gR4V3#) zY(provider, model, base_url, api_key) to switch from: live agent, else configured runtime.c3R<"TFp\SVR4;'gRxK R#5ir#)r)r%rrs& r r&)_current_model_runtime..s*_1]AGE1b ! ' 'R '1]s' 'r7r-r,r)resolve_runtime_providerN) requested target_model)r7r6r-r,) rrlstriphermes_cli.runtime_providerrr$callablerrJ)rr current_modelrruntimekeyr7sf& r _current_model_runtimers u_1]_u _u_1]__ _"$M &&(-R??D&MDYDYUYZG ++i $C SMM*S#"6"6#))n7;;z2.44"5H C J(C(I(Ir$JC OOr c$V^8dQhRRRRRR/#)rrrJcurrent_providerr str | Noner )r s"r r r s" - -C -3 -S] -r cV'g V'gV#\PPRR4P4;p'dV#\ 4'dR#\ 4^,;'gR#)a,The provider of the model the user leaves. Agent-less with ``--provider``, ``current_provider`` is the TARGET (what switch_model wants), so the launch route names it instead; None when only a credential resolve could tell, which the metric reads as ``unknown`` and so reports the model as ``custom``.HERMES_TUI_PROVIDERrN)osenvironr$r_env_model_seed_config_model_target)rrr env_providers&&& r _switch_away_providerrs\  %zz~~&;R@FFHH|H  !! $ , ,,r c V^8dQhRRRR/#)rrarrrr )r s"r r r s M MT MQU Mr c ^RIHpRp\V\4'dVP R/4MRp\V\4'd&VP R4e\ VR,4pV!W\ VP R.44WFR7R# \d"p\PRT4Rp?R#Rp?ii;i)zMFold the context-compression preflight warning into ``result`` (best-effort).)#merge_preflight_compression_warningNr6context_lengthhistory)rmessagescustom_providersconfig_context_lengthz/preflight-compression switch warning failed: %s) hermes_cli.context_switch_guardrrrr$intlistr2r3r4) resultrracfg custom_provsrcfg_ctxmcr_s &&&&& r _merge_preflight_warningrs MW%/T%:%:SWWWb ! b$  BFF+;$<$H"-./G+ $w{{9b/I*J) J M FLLMsBB C B<<Cc V^8dQhRRRR/#)rcurrent_base_urlrJrrr )r s"r r r siisi\gir c ^RIHpHpT!VPVPVP ;'gTVP ;'gTVPV!V4R7pVfR#VP'dVP RVP 2M VPpRVPRVRRR V/# \dRpLbi;i) uDeferred-confirm response when the selection guards flag the target model (or, with a live ``agent``, the switch itself — large cached context), else None.combined_selection_warningselection_context_for_agent)r7r-r, model_infoselection_contextNz valuewarningconfirm_requiredTconfirm_message) !hermes_cli.model_selection_guardsrrr*target_providerr-r,rr2warning_messagemessage)rrcurrent_api_keyrrrrmsgs&&&& r _expensive_model_confirmrs E,   v'='=HkHk[kNN55o&BSBS9%@B >D>T>T>TW__ T&"8"8!9 :ZaZiZiC V%%y#7I4Qbdg hh s2B7B7 B77 CCc$V^8dQhRRRRRR/#)rrsrJrarrr )r s"r r r s"44c4D4PS4r c *VPVPVPVPVPVP \ VRR4R7\Y4\T4\T4\YPTPR 7\Y4TeYQR &R#TP!R R4R# \dGp\PRT4\RTP RT R\ TRT4 R 24ThRp?ii;i) zWSwap the live agent in place, then restart/persist/mark/announce; a failed swap aborts.runtime_capabilitiesNr)z.In-place model switch failed for TUI agent: %szModel switch to z failed (z); staying on r6.)r6r7one_turn_model_restore)r!r*rr,r-r.rr2r3rr_restart_slash_worker_persist_live_session_runtime#_persist_live_session_system_prompt_append_model_switch_marker_emit_session_infor)rsrarrrrr_s&&&&&& r _commit_agent_switchrs[ &&V5K5KU[UcUc__v )?F  H#'!'*'0/?/?&J`J`as$,4() ,d3%  [ GM+F,<,<+=YseL''.ug}'M&NaQRWZ [ [sAC D AD  Dzmodel.large_noticeconfirm_expensive_modelFpin_session_overriderr count_switchc<V^8dQhRRRRRRRRRRR R R R R RRR/ #)rrsrJrarrrr;rrz Any | Nonerz bool | Nonerrr )r s"r r r 7srTVTV TVTV(+TVIMTVTV5?TV"TV9=TVIMTVr c^RIHp\W%V4wrrp VPR4pV 'dV'g \ R4h\ W4wppppR;p;pp\ P!\4;_uu_4^RI H pH pV!4pVPR4pV!V4pRRR4V!WVVVV V VVR7 pVP'g \ VP;'gR4hV 'dV'd \V4MRpV'd\VWVV4V'g\!VVVV4pVeV#T;'dH\#V\$4;'d0V '*;'d!V '*;'dVPR 4pR V9pVPR 4pV'd\'4wppR VR V/VR &V'd\)WVVVV4T'd`\#T\$4'dJT 'gBR TP,R TP.R TP0RTP2RTP4/TR&T 'd^RIHp T !T4T 'd\9YYYR7T'd<^RIHp!T!!\?YT4TP.\AT4T\CTRR4R7\CTRR4;p"'d-T'd%\ERTRRT" 2RRRRRR R!\FR"\F/4R#TP,R$TPH;'gRR%R&R'T 'dR(/#T 'dR)/#R*/# +'giEL;i \d+T'd!T'dTTR &hTP+R R4hi;i)+z``count_switch=False``: an internal swap (config adoption, MoA one-shot and its restore), not a user's /model pick, so it stays out of the shared-metrics switch count.)r!rz%/model --once requires a live sessionN)get_compatible_custom_providers load_config providers) rrrrrrruser_providersrzmodel switch failedfollow_profile_configcomposer_override_profiler6r7r-r,r.ry)persist_model_selection)persist_globalr)record_model_switch session_id) from_provider to_providersurface from_modelr usage_noticerznotification.showtextu⚠ levelwarnkindttlttl_msi@ridrrrFscopeonceglobalra)%rr!rr$rr contextlibsuppressr2hermes_cli.configrrsuccess error_messagerrrrrrrrr*rr-r,r.r_apply_switch_reasoning.hermes_cli.observability.shared_metrics_eventsrr_session_sourcer_emitLARGE_MODEL_NOTICE_KEYr)#rsrarrrrrrr!rrrrrrrrrr user_provsrrrrrrestore_snapshotconfirmrecords_composer_overridehad_composer_profileprevious_composer_profile profile_modelprofile_providerrrnotices#&&&$$$$$ r _apply_model_switchr7s 5Q`!1R3NKH>N KK E@AAI_ J"Fm%5'+*J*   Y ' 'RmWW[) 6s; ( P])?Vd+J% 'F >>>--FF1FGG@HU4U;Y]  lK "*63C_V[\  N H HGT!: H H8| H H  H H#*;;/F#G7'A ' ,G H *>*@' ' ]J0@0B+,   ufmM] ^ 7D 9 9( V%%z63I3I FNNJPVP_P_%a !C'eVdxV/JZ[..8P]julD9 ;&."5553 !3 d6(OWffeXt )41G)I J !!9f.D.D.J.JE8 VV7E( VVKT VVA ( ' '@  $#7P34  7> s*;)L.M M. L? M7M7M7c ,V^8dQhRRRRRRRRRR/#) rrsrJeffortrr;rrrr )r s"r r r s2)))c)VZ)fj)os)r c^RIHpV!V4pVfR#VeWrnV'g\V\4'gR#V'd \ RV4VP RR4MWqR&Ve\V4\W4R#R#)uf``/model X --reasoning ``: the effort rides with the pick and shares its scope. Runs AFTER ``agent.switch_model`` (which re-resolves ``reasoning_config`` from config.yaml, so an earlier write would be clobbered). ``--once`` restores through ``one_turn_model_restore`` — the snapshot's ``primary_runtime`` carries the pre-switch ``reasoning_config``.)parse_reasoning_effortNzagent.reasoning_effortcreate_reasoning_override) hermes_constantsrrrr_write_config_keyrrr)rsrarrrrrparseds&&&&$$ r r r sx 8 #F +F ~ !'z'4002F; /6/5+, %g.3(r c$V^8dQhRRRRRR/#rrsrJrarrrr )r s"r r r s&#H#H#Hd#Ht#Hr c~VPR4pVfR#\\VRR4;'gR4P4pV'gl\VRR4VPR4;'gRrT\V'dV'dVP V4MR;'gR4P4pVR8wdR#^RIHpT!VPR 4;'gR4pVR 8XdR#VPR 4pWqR &VeW8XdR#\T\T4R 7p \YTR,\T4R 7p \T 4RT n \RTRR/4R# \dR#i;i \T 4i;i \d"p \P!RY 4Rp ? R#Rp ? ii;i)a1Rebuild a Bot Chat session's agent when its capability surface changed. Bot Chats are eternal sessions with toolsets/MCP baked in at construction, so a capability edit would otherwise wait for /new: fingerprint at turn start and on change swap in a fresh agent for the SAME session (history is DB-backed).rN_session_title_hintr _session_db session_keyzBot Chat)capability_fingerprintrB unavailable bot_caps_seen)cwd)rplatform_overriderruDCapabilities updated — this bot's tools and prompt were refreshed.z%Bot capability sync failed for %s: %s)r$rJrrget_session_titletools.bot_mode_prober(r2_set_session_context _session_cwd_rebuild_session_agentr _clear_session_contextr%rr3r) rsrartitledbrr(currentseentokens new_agentes && r _sync_bot_capabilitiesr:s KK E }GE#8"=CCDJJLe]D97;;};U;[;[Y[rc--c2SSQSTZZ\E J  ?(^)D)L)LM m # {{?+#* <4? + H%c|G/DE +.sP]H^APQXAY[I #6 *(2 % hi)opq  #6 * H>GGHspE.E.#E.3E. E.%E.E.#E.3E.F-F !F. E=<E= F  F F<F77F<c$V^8dQhRRRRRR/#r#r )r s"r r r s&.e.es.eT.ed.er c aa a VPR4pVfR#\4pV^,'gR#VPR4pW48XdR#RpVPR4'dVPR4p\V\4'de\ VPR4;'gR4P 4\ VPR4;'gR4P 43MRpVeWs8XdR#VP R4V3pRVR&W1R&Vwo pS \VRR48Xd,V'dV\VRR48XdVe \V4R#V'dS R V 2MS p \SWR R R R R 7R# \dUo \PR S SS 4^RI Hp T !T T T3RlR\TPR4RR4R7Ro > R#Ro > ii;i)zAdopt a config.yaml model change at turn start (like gateways do per message). Sessions pinned with /model keep their choice; a failed switch keeps the current model.rNconfig_model_seenryrr6rr7z --provider TF)rrrrz;Configured model %s could not be adopted for session %s: %s)render_notificationc .<\RSRRS RS 2/4#)errorrz%Could not switch to configured model z: )r)r9r6rssr /_sync_agent_model_with_config..s&E'36[\a[bbdefdg4h(ijr tui_notification_config)platform user_config)r$rrrrJrrrrrr2r3rgateway.warning_notificationsr>) rsrartargetr6superseded_pincomposer_profilepinned_profiler7rawr>r9r6s f& @@r _sync_agent_model_with_configrMs KK E } ! #F !99 ;;* +D ~N{{#$$";;'BC($ / /  $$W-33 4 : : <  $$Z066B 7 = = ? 6:   !^%= !%568HH/3+,#)  OE8 w++XWUZ\fhjMkAk  % )' 2.6UG<z *EC e  tRW" 8 eTV[]`bcdE j G0DF\^b(c e ees1F G#A GG#c(V^8dQhRRRRRRRR/#)rr6rJr7rAnyrrr )r s"r r r s)<r^sL# 4   I XB:747t* 6T66 $L2p,P& - Mi&48.TVPUTV!%TVBFTV%)TV@DTVn).#HL.eb<$0r