)j UdZddlZddlZddlZddlZddlZddlmZddlm Z ddl m Z m Z m Z mZmZmZddlmZmZmZerddlmZdaeeed<d efd ZGd d ZeZdd lmZddlmZddl m!Z!ddl"m#Z#m$Z$m%Z%m&Z&ej'e(Z)de de d e*fdZ+de,fdZ-da.idddddddddddddd d!d d"d d#d d$d%d&d%d'd(d)d(d*d+d,d+d-d.d.d/d/d0d0d0d0d1d1d2d2d2d2d3 Z/d4ee,d e,fd5Z0e1Z2e1ed6<d7ee,d e*fd8Z3d7ee,d e*fd9Z4d:Z5d9d7ee,d4ee,d e*fd;Z6 d9d7ee,dZ7 d9d?d@d7ee,d4ee,dAe*d ee8fdBZ9dCe,d e,fdDZ:dEdFdGdHdGdIdJdKdLdMdNdOdP Z;e e,e,fedQ<e;Zd%d(hZ?e>edW<dXdYdZd[Z@e>hd\ZAd]eBdzd eBdzfd^ZCd9d_eBdzd eBfd`ZDdadbiZEdde,de,de,d eee ee,e,ffdZ d?de,de,de,d eee ee,e,ffdZ d@de,de,de,d eee ee,e,ffdZ dAd4e,d7ee,dhd-Zd4e,d.provider + auxiliary..model). Per-task overrides are configured in config.yaml under the ``auxiliary:`` section (e.g. ``auxiliary.vision.provider``, ``auxiliary.compression.model``). Default "auto" follows the chains above. Payment / credit exhaustion fallback: When a resolved provider returns HTTP 402 or a credit-related error, call_llm() automatically retries with the next available provider in the auto-detection chain. This handles the common case where a user depletes their OpenRouter balance but has Codex OAuth or another provider available. N)Path)SimpleNamespace)AnyDictListOptionalTuple TYPE_CHECKING)urlparseparse_qs urlunparseOpenAI_OPENAI_CLS_CACHEreturnc.tddlm}|atS)z#Import and cache ``openai.OpenAI``.Nrr)ropenair)_clss ;/home/ubuntu/.hermes/hermes-agent/agent/auxiliary_client.py_load_openai_clsrHs( ))))))  c(eZdZdZdZdZdZdZdS) _OpenAIProxyzModule-level proxy that looks like the ``openai.OpenAI`` class. Forwards ``OpenAI(...)`` calls and ``isinstance(x, OpenAI)`` checks to the real SDK class, importing the SDK lazily on first use. c*t|i|SN)r)selfargskwargss r__call__z_OpenAIProxy.__call__Zs!!!426222rc:t|tSr) isinstancer)robjs r__instancecheck__z_OpenAIProxy.__instancecheck__]s#/11222rcdS)Nzrrs r__repr__z_OpenAIProxy.__repr__`s++rN)__name__ __module__ __qualname____doc__ __slots__r r$r'rrrrrQsR I333333,,,,,rr) load_pool)get_hermes_home)OPENROUTER_BASE_URL)base_url_host_matchesbase_url_hostname"model_forces_max_completion_tokensnormalize_proxy_env_varsr# maybe_typecF t||S#t$rYdSwxYw)zDReturn False instead of raising when a patched symbol is not a type.F)r" TypeError)r#r4s r_safe_isinstancer7ns9#z*** uus   urlct|}|jrWt|d}dt |jD}||fS|dfS)zNExtract query params from URL, return (clean_url, default_query dict or None).)queryc&i|]\}}||dSrr).0kvs r z-_extract_url_query_params..{s"EEEda!QqTEEErN)r r;r _replacer items)r8parsedcleanparamss r_extract_url_query_paramsrGvso c]]F |6???4455EEhv|&<&<&B&B&D&DEEEf} 9rFgooglegeminiz google-geminizgoogle-ai-studiozx-aixaizx.aigrokglmzaizz-aizz.aizhipukimi kimi-codingmoonshotzkimi-cnkimi-coding-cnz moonshot-cnz gmi-cloudgmigmicloudz minimax-china minimax-cn anthropiccopilot copilot-acptencent-tokenhub) minimax_cnclaudez claude-codegithubzgithub-copilotz github-modelz github-modelszgithub-copilot-acpzcopilot-acp-agenttencenttokenhubz tencent-cloud tencentmaasproviderc|pd}|dr4|ddd}|sdS|}|dkrdS|dkr?t pd }|r|d vr|}ndSt ||S) Nautocustom::customcodex openai-codexmainr:>r:rbri)striplower startswithsplit_read_main_provider_PROVIDER_ALIASESget)r` normalizedsuffix main_provs r_normalize_aux_providerrts$f++--3355JY''!!#q))!,2244 8 W~V)**0b7799??AA  *>>>"JJ8  Z 8 88rOMIT_TEMPERATUREmodelc|pdddd}|dp|dkS)zHTrue for any Kimi / Moonshot model that manages temperature server-side.r:/rezkimi-rOrjrkrsplitrlrvbares r_is_kimi_modelr~sS KR   & & ( ( / /Q 7 7 ;D ??7 # # 5tv~5rc|pdddd}|dkS)zATrue for Arcee Trinity Large Thinking (direct or via OpenRouter).r:rxreryztrinity-large-thinking)rjrkr{r|s r_is_arcee_trinity_thinkingrsD KR   & & ( ( / /Q 7 7 ;D + ++rg333333?cF|pd}|dkrdS|pdddd}|dkp)|dp|d S) uTrue for gpt-5.5 accessed through the ChatGPT Codex OAuth backend. Matches only the Codex OAuth route (provider ``openai-codex``), not the direct OpenAI API, OpenRouter, or GitHub Copilot paths — those expose a larger context window for the same slug and must keep the user's default compaction threshold. ``gpt-5.5-pro`` and dated snapshots (``gpt-5.5-2026-04-23``) are matched via prefix so the override tracks the family without re-listing every variant. r:rhFrxreryzgpt-5.5zgpt-5.5-zgpt-5.5.rz)rvr`provr}s r_is_codex_gpt55rs N ! ! # # ) ) + +D ~u KR   & & ( ( / /Q 7 7 ;D 9  Z ; ; Ztz?Z?ZZrbase_urlzOptional[float] | objectct|r"td|tSt |rdSdS)uReturn a temperature directive for models with strict contracts. Returns: ``OMIT_TEMPERATURE`` — caller must remove the ``temperature`` key so the provider chooses its own default. Used for all Kimi / Moonshot models whose gateway selects temperature server-side. ``float`` — a specific value the caller must use (reserved for future models with fixed-temperature contracts). ``None`` — no override; caller should use its own default. z7Omitting temperature for Kimi model %r (server-managed)g?N)r~loggerdebugrur)rvrs r_fixed_temperature_for_modelrsJe  NPUVVV!%((s 4rT)allow_codex_gpt55_autoraisercZt|rdS|rt||rtSdS)uHReturn a context-compression threshold override for specific models. The threshold is the fraction of the model's context window that must be consumed before Hermes triggers summarization. Higher values delay compression and preserve more raw context. Per-model/route overrides: - Arcee Trinity Large Thinking → 0.75 (preserve reasoning context). - gpt-5.5 on the Codex OAuth route → 0.85, because Codex caps the window at 272K and the default 50% trigger would compact at ~136K. Gated by ``allow_codex_gpt55_autoraise`` so the user can opt back down to the global default (the caller passes the config flag through here). Returns a float in (0, 1] to override the global ``compression.threshold`` config value, or ``None`` to leave the user's config value unchanged. g?N)rr!_CODEX_GPT55_COMPACTION_THRESHOLD)rvr`rs r _compression_threshold_for_modelrs=,"%((t"1uh'G'G100 4r provider_idc ddlm}||}|r|jr|jSn#t$rYnwxYwt|dS)zReturn the cheap auxiliary model for a provider. Reads from ProviderProfile.default_aux_model first, falling back to the legacy hardcoded dict for providers that predate the profiles system. rget_provider_profiler:) providersrdefault_aux_model Exception%_API_KEY_PROVIDER_AUX_MODELS_FALLBACKrp)rr_ps r_get_aux_model_for_providerrs{  222222 ! !+ . .  ("& (' '      0 4 4[" E EEs $ 11zgemini-3-flash-previewz glm-4.5-flashzkimi-k2-turbo-previewzstep-3.5-flashz$google/gemini-3.1-flash-lite-previewclaude-haiku-4-5-20251001zgemini-3-flashzglm-5zgoogle/gemini-3-flash-previewznemotron-3-nano:30bz hy3-preview) rIrMrPstepfunrRrSrVz opencode-zenz opencode-gokilocodez ollama-cloudrYr_API_KEY_PROVIDER_AUX_MODELSz mimo-v2.5z glm-5v-turbo)xiaomirM_PROVIDER_VISION_MODELS_PROVIDERS_WITHOUT_VISIONz%https://hermes-agent.nousresearch.comz Hermes Agentzproductivity,cli-agent)z HTTP-RefererzX-TitlezX-OpenRouter-Categories>1onyestrueheadersc8 ddlm}m}||dd}n#t$r|cYSwxYwt |t r|s|St |pi}|D]'\}}|t||t|<(|p|S)uMerge user-configured ``model.default_headers`` onto resolved headers. User values take precedence over provider/SDK defaults, mirroring the main agent client (``AIAgent._apply_user_default_headers``). This lets a ``custom`` OpenAI-compatible endpoint behind a gateway/WAF that rejects the OpenAI SDK's identifying headers (``User-Agent: OpenAI/Python ...``, ``X-Stainless-*``) override them for auxiliary calls too — otherwise the main turn would succeed but title/compression/vision calls to the same endpoint would still fail. (#40033) Returns the merged dict, or the original ``headers`` (possibly ``None``) when nothing is configured. No allocation when there are no overrides. r)cfg_get load_configrvdefault_headers)hermes_cli.configrrrr"dictrCstr)rrr user_headersmergedkeyvalues r_apply_user_default_headersrhs::::::::w{{}}g7HII  lD ) ) '-R F"((**&& U = u::s3xx  Ws  // or_configc6tt}|8 ddlm}|di}n#t $ri}YnwxYwt jdd }|r |tv}n|dd}|s|Sd |d <t jd d}|rF| r1t|}d |cxkrd krnntt||d<na|dd}t|ttfr/d |cxkrd kr"nntt||d<|S)uBuild OpenRouter headers, optionally including response-cache headers. Precedence for response cache: env var > config.yaml > default (enabled). Environment variables: ``HERMES_OPENROUTER_CACHE`` — truthy (``1``/``true``/``yes``/``on``) enables caching; ``0``/``false``/``no``/``off`` disables. Overrides ``openrouter.response_cache`` in config.yaml. ``HERMES_OPENROUTER_CACHE_TTL`` — integer seconds (1-86400). Overrides ``openrouter.response_cache_ttl`` in config.yaml. *or_config* is the ``openrouter`` section from config.yaml. When *None*, falls back to reading config from disk via ``load_config()``. Nrr openrouterHERMES_OPENROUTER_CACHEr:response_cacheFrzX-OpenRouter-CacheHERMES_OPENROUTER_CACHE_TTLreiQzX-OpenRouter-Cache-TTLresponse_cache_ttli,)r_OR_HEADERS_BASErrrprosenvironrjrk_TRUTHY_ENV_VALUESisdigitintrr"float)rrr env_cache cache_enabledenv_ttlttls rbuild_or_headersrs#$$G  5 5 5 5 5 5# )),;;II   III  8"==CCEEKKMMI?!%77 ! &6>> $*G !jnn:B??EEGGG> ??   =g,,CC    5     47HH01mm0#66 cC< ( ( >Q#->->->->->->->->->03CHH G, - Ns$= A  A zX-BILLING-INVOKE-ORIGIN HermesAgentcltt|pddrttSiS)zIReturn NVIDIA NIM cloud attribution headers for build.nvidia.com traffic.r:integrate.api.nvidia.com)r0rr_NVIDIA_NIM_CLOUD_HEADERS)rs rbuild_nvidia_nim_headersrs5SR002LMM/-... Ir)nous_portal_tagsc"dtiS)zReturn a fresh Nous Portal ``extra_body`` dict. Computed at call time so a hot-reloaded ``hermes_cli.__version__`` is reflected without restarting long-running processes. tags)_nous_portal_tagsrrr_nous_extra_bodyrs %'' ((rauxiliary_is_nousz)https://inference-api.nousresearch.com/v1zhttps://api.anthropic.comz auth.jsonz%https://chatgpt.com/backend-api/codex access_tokencddd}t|tr|s|S ddl}|d}t |dkr|S|dd t |d d zzz}t j||}| d i d }t|tr|r||d <n#t$rYnwxYw|S)uHeaders required to avoid Cloudflare 403s on chatgpt.com/backend-api/codex. The Cloudflare layer in front of the Codex endpoint whitelists a small set of first-party originators (``codex_cli_rs``, ``codex_vscode``, ``codex_sdk_ts``, anything starting with ``Codex``). Requests from non-residential IPs (VPS, server-hosted agents) that don't advertise an allowed originator are served a 403 with ``cf-mitigated: challenge`` regardless of auth correctness. We pin ``originator: codex_cli_rs`` to match the upstream codex-rs CLI, set ``User-Agent`` to a codex_cli_rs-shaped string (beats SDK fingerprinting), and extract ``ChatGPT-Account-ID`` (canonical casing, from codex-rs ``auth.rs``) out of the OAuth JWT's ``chatgpt_account_id`` claim. Malformed tokens are tolerated — we drop the account-ID header rather than raise, so a bad token still surfaces as an auth error (401) instead of a crash at client construction. z!codex_cli_rs/0.0.0 (Hermes Agent) codex_cli_rs) User-Agent originatorrN.re=zhttps://api.openai.com/authchatgpt_account_idzChatGPT-Account-ID) r"rrjbase64rmlenjsonloadsurlsafe_b64decoderpr)rrrparts payload_b64claimsacct_ids r_codex_cloudflare_headersrs%&:$G lC ( ( 0B0B0D0D   ""3'' u::>>NAhU1X(:!;; F44[AABB**:B??CCDXYY gs # # 4 4,3G( )      Ns-C2 BC22 C?>C?ct|pdd}|drzd|vsd|vr9|dt d dz}t d|||S|dt d d z}t d |||Sd |vr8|d r#|d z}t d |||S|S)uNormalize an Anthropic-style base URL to OpenAI-compatible format. Some providers (MiniMax, MiniMax-CN) expose an ``/anthropic`` endpoint for the Anthropic Messages API and a separate ``/v1`` endpoint for OpenAI chat completions. The auxiliary client uses the OpenAI SDK, so it must hit the ``/v1`` surface. Passing the raw ``inference_base_url`` causes requests to land on ``/anthropic/chat/completions`` — a 404. r:rx /anthropiczopen.bigmodel.cnbigmodelNz/paas/v4u0Auxiliary client: rewrote ZAI base URL %s → %sz/v1u,Auxiliary client: rewrote base URL %s → %s api.kimi.com/codingu1Auxiliary client: rewrote Kimi base URL %s → %s)rrjrstripendswithrrr)rr8 rewrittens r_to_openai_base_urlrs hn"   # # % % , ,S 1 1C ||L!!   $ $ c(9(90s<00001J>I LLKSR[ \ \ \ ,3|,,,,-5  CS)TTTi!8!8%K  H#yYYY JrcR t|}n4#t$r'}td||Yd}~dSd}~wwxYw|r|sdS d|fS#t$r'}td||Yd}~dSd}~wwxYw)z2Return (pool_exists_for_provider, selected_entry).z0Auxiliary client: could not load pool for %s: %sN)FNTz8Auxiliary client: could not select pool entry for %s: %s)TN)r-rrrhas_credentialsselect)r`poolexcs r_select_pool_entryr<s""  GSVWWW{{{{{ t++--{T[[]]""  OQY[^___zzzzzs* A>AA55 B&?B!!B&c t|}n4#t$r'}td||Yd}~dSd}~wwxYw|r|sdS t |dd}t |r|}||St |dd}t |r |Sn3#t$r&}td||Yd}~nd}~wwxYwdS)zEBest-effort current/next pool entry without mutating selection order.z7Auxiliary client: could not load pool for %s (peek): %sNcurrentpeekz6Auxiliary client: could not peek pool entry for %s: %s)r-rrrrgetattrcallable)r`rr current_fnrpeek_fns r_peek_pool_entryrLs;""  NPXZ]^^^ttttt t++--t ^T9d33 J    jllG"$-- G   799   ^^^ MxY\]]]]]]]]^ 4s0 A>A-B8 )B88 C(C##C(entryc|dSt|ddpt|dd}t|pdS)Nr:runtime_api_keyr)rrrj)rrs r_pool_runtime_api_keyrcsN }r %*D 1 1 WWUNTV5W5WC syb>>   ! !!rr:fallbackcH|6t|pddSt|ddp#t|ddpt|ddp|}t|pddS)Nr:rxruntime_base_urlinference_base_urlr)rrjrr)rrr8s r_pool_runtime_base_urlrls }8>r""((**11#666 )400  5. 5 5  5*d + +    syb>>   ! ! ( ( - --rc.eZdZdZdedefdZdefdZdS)_CodexCompletionsAdapterzyDrop-in shim that accepts chat.completions.create() kwargs and routes them through the Codex Responses streaming API. real_clientrvc"||_||_dSr)_client_model)rrrvs r__init__z!_CodexCompletionsAdapter.__init__s"  rrc H,-./01|dg}|dj}ddlm}d}g}|D]q}|dd}|dpd } |d kr't | t r| nt | }\||r||} ||| pdd d gd d } |d} | | | d<|dpi} t | tro| d}t |trE|dd urn-|dpd}|dkrd}|dd| d<dg| d<|d}|r ddl}ddl m }m }| t|}||\}}||\}}n2#t$r%}td|Yd}~nd}~wwxYwg}|D]}t |tr|dini}|d}|sG|d||dd |d id!|r|| d<g}g}d}t | t"t$fr| dkr| nd11r#t'jt%1znd/t+j0d}d"t f1fd# .dI0fd$ -dI-./0fd% , 1r=t+jt%1-}d&|_|,dd'lm}t| }d&|d(<d)t8d"df,fd* } jjjdJi|}! ||!| d| +}"tA|!d,d}#tC|#r |#nR#t$rYnFwxYwnA#tA|!d,d}#tC|#r |#w#t$rYwwxYwwxYw|"tEd-dKd.t8d/t d0t8d"t8fd1}$tA|"d2dpgD]}%|$|%d3}&|&d4krB|$|%dpgD]2}'|$|'d3}(|(d5vr ||$|'d6d 3V|&d7krU|tG|$|%d8d dtG|$|%dd |$|%d9d:;<tA|"d=d})|)rtGtA|)d>dp,t |)tr|)d>dndtA|)d?dp,t |)tr|)d?dndtA|)d@dp,t |)tr|)d@dndA}nZ#t$rM}0$rtK.|t&dB|d}~wwxYw||'n#||'wwxYwd (|)pd} tGdC| |pdD}*tGd|*|sdEndFG}+tG|+g||HS)LNmessagesrvr)!_chat_messages_to_responses_inputzYou are a helpful assistant.roleusercontentr:system)r rF)rv instructionsinputstoretimeout extra_body reasoningenabledeffortmediumminimallowrb)rsummaryzreasoning.encrypted_contentincludetools)strip_pattern_and_formatstrip_slash_enumzRAuxiliary client: failed to sanitize tool schemas for Codex/xAI Responses path: %sfunctionname description parameters)typer!r"r#rc,dtddS)Nz*Codex auxiliary Responses stream exceeded z.1fzs total timeout)r) total_timeoutsr_timeout_messagez9_CodexCompletionsAdapter.create.._timeout_message sim@T@Tiiii ircntjdd}t|r8 |n,#t$rt ddYnwxYw tjdS#t$r t ddYdSwxYw)Nclosez3Codex auxiliary: client close during timeout failedTexc_infoz1Codex auxiliary: cache eviction on timeout failed)setrrrrrr_evict_cached_client_instance)r)r timed_outs r_close_client_on_timeoutzA_CodexCompletionsAdapter.create.._close_client_on_timeouts MMOOODL'488E ggEGGGG gggLL!VaeLfffffg a-dl;;;;; a a a P[_ `````` as# A&A0/A04B &B43B4cLtjkr5s t ddlm}|rt ddS#t $rt$rYdSwxYw)Nr)is_interruptedz,Codex auxiliary Responses stream interrupted)time monotonicis_set TimeoutErrortools.interruptr1InterruptedErrorr)r1r/r'deadliner.s r_check_cancelledz9_CodexCompletionsAdapter.create.._check_cancelled!s#(8(8H(D(D ''))/,,..."#3#3#5#5666 ::::::!>##[*+YZZZ[[#       sA22B  B T)_consume_codex_event_streamstream_eventcdSrr)r<r9s r_on_each_eventz7_CodexCompletionsAdapter.create.._on_each_eventGs! """""r)rvon_eventr)z@Codex auxiliary Responses stream did not return a final responser#rdefaultct||d}|+t|tr|||}||n|Sr)rr"rrp)r#rr@vals r _item_getz2_CodexCompletionsAdapter.create.._item_getasGc3--;:c4#8#8;''#w//C!oss7:routputr$message>text output_textrF function_callcall_id argumentsz{})r!rJ)idr$r usage input_tokens output_tokens total_tokens prompt_tokenscompletion_tokensrOz-Codex auxiliary Responses API call failed: %s assistant)r r tool_callsstoprTindexrE finish_reasonchoicesrvrLrNrr)*rpragent.codex_responses_adapterr r"rappendrcopytools.schema_sanitizerrrdeepcopylistrrwarningrrr2r3 threadingEventTimerdaemonstartagent.codex_runtimer:rr responsescreaterr RuntimeErrorrr4r5rcanceljoinrj)2rrr rvr rreplay_messagesmsgr r input_items resp_kwargsrr reasoning_cfgrr_copyrr_r convertedtfnr! text_partstool_calls_rawrL timeout_timerr: stream_kwargsr> event_streamfinalclose_fnrCitem item_typepartptype resp_usagerEchoicer9r/r'r8r.r&s2` @@@@@@rrjz_CodexCompletionsAdapter.creates ::j"-- 7DK00 TSSSSS5 02 , ,C7766**Dggi((.BGx*4Wc*B*BTwwG &&s++++77HH ( Ef%D%D$E ' ' **Y''  %,K "ZZ --3 j$ ' ' M&NN;77M-.. M $$Y//588 +..x88DHF**!&"(#)00K ,/L-LK * 7## % 1 $$$$tE{{3333E::q++E22qq   347  I  .8D.A.AIQUU:r***rvvf~~  & #%66-#<#<"$&&r":": ""  1'0 G$!# $&#-gU|#D#D^STZ^ >KU4>##eM&:&:::QUO%% 37  j# j j j j j j a a a a a a a&          X ' & )m0D0DF^ _ _ '+ $##%%%      H G G G G G --M&*M( # #s #t # # # # # # 94<18II=IIL 33 %//'22+ #<$??H%%  $#<$??H%%  $ }"#efff  ; ;s ; ;s ;c ; ; ; ; !$77=2  %IdF33  ))!*4!;!;!ArKK ) $ 7 7 $;;;&--iifb.I.IJJJK/11"))/$9T9b99'!0!*4!1===cd&-j/1&M&M'gBLZY]B^B^eJNN?A>>>de!(^Q!G!G"fAKJX\A]A]dJNN>1===cd    !! @"#3#3#5#566C? LLH# N N N    ($$&&&($$&&&&)''*%%++--5"%-    !(6H&&L    H    sA G** H4HH7B X1!P" X1 P X1 PX1PX1!Q Q  Q QQQQGX10Z"1 Z;AZZZ""Z;N) r(r)r*r+rrrrrjrrrrrsb>>F3T #T T T T T T rrceZdZdZdefdZdS)_CodexChatShimz>Wraps the adapter to provide client.chat.completions.create().adapterc||_dSr completionsrrs rrz_CodexChatShim.__init__"rN)r(r)r*r+rrrrrrrs6HH# 8######rrc(eZdZdZdedefdZdZdS)CodexAuxiliaryClientzOpenAI-client-compatible wrapper that routes through Codex Responses API. Consumers can call client.chat.completions.create(**kwargs) as normal. Also exposes .api_key and .base_url for introspection by async wrappers. rrvc||_t||}t||_|j|_|j|_dSr) _real_clientrrchatapi_keyr)rrrvrs rrzCodexAuxiliaryClient.__init__s@'*;>>"7++ "* #, rc8|jdSr)rr)r&s rr)zCodexAuxiliaryClient.closes !!!!!rN)r(r)r*r+rrrr)rrrrrsO -F-3----"""""rrc*eZdZdZdefdZdefdZdS)_AsyncCodexCompletionsAdapterzAsync version of the Codex Responses adapter. Wraps the sync adapter via asyncio.to_thread() so async consumers (web_tools, session_search) can await it as normal. sync_adapterc||_dSr_syncrrs rrz&_AsyncCodexCompletionsAdapter.__init__ ! rrcJKddl}|j|jjfi|d{VSNrasyncio to_threadrrjrrrs rrjz$_AsyncCodexCompletionsAdapter.createA&W&tz'8CCFCCCCCCCCCrN)r(r)r*r+rrrrjrrrrrs\ "%=""""DDDDDDDrrceZdZdefdZdS)_AsyncCodexChatShimrc||_dSrrrs rrz_AsyncCodexChatShim.__init__rrN)r(r)r*rrrrrrrs0# =######rrceZdZdZddZdS)AsyncCodexAuxiliaryClientzHAsync-compatible wrapper matching AsyncOpenAI.chat.completions.create(). sync_wrapperrc|jj}t|}t||_|j|_|j|_|j|_dSr)rrrrrrrrrr async_adapters rrz"AsyncCodexAuxiliaryClient.__init__sP#(4 5lCC ' 66 #+ $- )5rN)rr)r(r)r*r+rrrrrrs.RR 6 6 6 6 6 6rrc4eZdZdZd dededefdZdefdZd S) _AnthropicCompletionsAdapterzrbnonerequired)rvr rrreasoning_configrr_forbids_sampling_paramsanthropic_messages)strip_tool_prefix)rrTrrLrMrNrOrPrVrYr)agent.anthropic_adapterragent.transportsrrprpopr"rrrkrrrr rjnormalize_responserrrTrrXhasattrrLr)rrrrr rvrr_skip_mtrrnormalized_tool_choice choice_typeanthropic_kwargsrresponse _transport_nrassistant_messagerXrLrQrRrOrs rrjz#_AnthropicCompletionsAdapter.creates!BBBBBB222222::j"-- 7DK00 7##jj// ::4e<<  aJJL11`VZZ@W5X5X`\`Jjj// !% k3 ' ' 5%0 " "  T * * 5koofb99::@@BBKj(()4R)H)H)L)LV)T)T&& <<<)4&11!!.^     " H H H H H H++E22 >2= //4<(/CC2BCC"]#788 ++ ,   ,K~m    )  8W % % (. #HNNAFFK!M ' K K Pq "8>>1EEl-ZkJkL#+"3)E !%'    H    rNF) r(r)r*r+rrboolrrjrrrrrsjFF""C""t"""" P #P P P P P P rrceZdZdefdZdS)_AnthropicChatShimrc||_dSrrrs rrz_AnthropicChatShim.__init__;rrN)r(r)r*rrrrrrr:s0# <######rrc 6eZdZdZd dededededef dZd Zd S) AnthropicAuxiliaryClientz@OpenAI-client-compatible wrapper over a native Anthropic client.Frrvrrrc|||_t|||}t||_||_||_dS)Nr)rrrrrr)rrrvrrrrs rrz!AnthropicAuxiliaryClient.__init__Bs?'.{EHUUU&w//    rcht|jdd}t|r |dSdS)Nr))rrr)rr~s rr)zAnthropicAuxiliaryClient.closeIs?4,gt<< H    HJJJJJ  rNr) r(r)r*r+rrrrr)rrrrr?sfJJ!!C!!c!S!\`!!!!rrc&eZdZdefdZdefdZdS)!_AsyncAnthropicCompletionsAdapterrc||_dSrrrs rrz*_AsyncAnthropicCompletionsAdapter.__init__PrrrcJKddl}|j|jjfi|d{VSrrrs rrjz(_AsyncAnthropicCompletionsAdapter.createSrrN)r(r)r*rrrrjrrrrrOsR"%A""""DDDDDDDrrceZdZdefdZdS)_AsyncAnthropicChatShimrc||_dSrrrs rrz _AsyncAnthropicChatShim.__init__YrrN)r(r)r*rrrrrrrXs0# A######rrceZdZddZdS)AsyncAnthropicAuxiliaryClientrrc|jj}t|}t||_|j|_|j|_|j|_dSr)rrrrrrrrs rrz&AsyncAnthropicAuxiliaryClient.__init__^sP#(4 9,GG +M:: #+ $- )5rN)rr)r(r)r*rrrrrr]s(666666rrc|pdd}|sdS|drdSt |}|dkrdS|dkrd|vrdSdS) uTrue if the endpoint at ``base_url`` speaks the Anthropic Messages protocol instead of OpenAI chat.completions. Mirrors ``hermes_cli.runtime_provider._detect_api_mode_for_url`` so the auxiliary client and the main agent stay in sync on transport selection. Covers: - Any URL ending in ``/anthropic`` (MiniMax, Zhipu GLM, LiteLLM proxies, Anthropic-compatible gateways). - ``api.kimi.com/coding`` (Kimi Coding Plan — the /coding route only speaks Claude-Code's native Anthropic shape; ``chat.completions`` returns 404 on Anthropic-only model aliases like ``kimi-for-coding``). - ``api.anthropic.com`` (native Anthropic). r:rxFrTapi.anthropic.comrr)rjrkrrr1)rrqhostnames r#_endpoint_speaks_anthropic_messagesris.b''))//1188==J u<((t ,,H&&&t>!!i:&=&=t 5r client_objrapi_modect|tr|St|tr|S ddlm}t||r|Sn#t $rYnwxYw ddlm}t||r|Sn#t $rYnwxYw|r|dkr|S|dkpt|}|s|S ddl m }n-#t $r t d||cYSwxYw |||} n5#t$r(} t d|| |cYd} ~ Sd} ~ wwxYwtd ||r |dd nd |pd t| |||d S)aRewrap a plain OpenAI client in ``AnthropicAuxiliaryClient`` when the endpoint actually speaks Anthropic Messages. This is the single chokepoint for aux-client transport correction. Runs at the end of every ``resolve_provider_client`` branch so that api_key providers (Kimi Coding Plan), the ``custom`` endpoint, and future /anthropic gateways all land on the right wire format regardless of which branch built the client. Returns ``client_obj`` unchanged when: - It's already an Anthropic/Codex/Gemini/CopilotACP wrapper. - The endpoint is an OpenAI-wire endpoint. - ``api_mode`` is explicitly set to a non-Anthropic transport. - The ``anthropic`` SDK is not installed (falls back to OpenAI wire). r)GeminiNativeClientCopilotACPClientrbuild_anthropic_clientuEndpoint %s speaks Anthropic Messages but the anthropic SDK is not installed — falling back to OpenAI-wire (will likely 404).uTFailed to build Anthropic client for %s (%s) — falling back to OpenAI-wire client.NzeAuxiliary transport: wrapping client in AnthropicAuxiliaryClient (model=%s, base_url=%s, api_mode=%s)<r: auto-detectedFr)r7rragent.gemini_native_adapterr ImportErroragent.copilot_acp_clientrrrrrrbrr) rrvrrrrr should_wraprrrs r_maybe_wrap_anthropicrsZ0 $<== $899 BBBBBB J(: ; ;          ====== J(8 9 9         H 444 (( 9 .x 8 8 BBBBBBB  O     ,,Wh??  "#+S     LL / 0x}}b(2Mo $UGX   sSA AAA33 B?B'B..'CC C)) D3DDDc td\}}|r|dSt|ddt|ddt|ddt|tt|ddt|ddt|d dt|d d d d S tsdSt jt}| ddkrdS| di di}| ds| dsdS|S#t$r&}t d|Yd}~dSd}~wwxYw)zRead and validate ~/.hermes/auth.json for an active Nous provider. Returns the provider state dict if Nous is active with tokens, otherwise None. nousNrr: refresh_token agent_keyportal_base_url client_idscope token_typeBearerr) rrrrrrrrsourceactive_providerrzCould not read Nous auth: %s) rrr_NOUS_DEFAULT_BASE_URL_AUTH_JSON_PATHis_filerr read_textrprrr) pool_presentrdatar`rs r_read_nous_authrs -V44L%  =4#E>2>>$UOTBB  T::"8@V"W"W&u.?FF  T::UGT22!%x@@    &&(( 4z/335566 88% & && 0 0488K,,00<<||K(( n1M1M 4  3S999ttttts,"E=AEAEE F %FF cddlm}dD]|\}}||}t|tr|sD|||d||r|cS}dS)z;Extract a usable Nous inference JWT from stored auth state.r)_nous_invoke_jwt_is_usable))ragent_key_expires_at)r expires_atr)rr r:)hermes_cli.authrrpr"rrj)r`r token_key expiry_keytokens r _nous_api_keyrs::::::"   : Y''%%% U[[]]   % % ,,w''||J//     LLL   2rc6tjdtS)z8Resolve the Nous inference base URL from env or default.NOUS_INFERENCE_BASE_URL)rgetenvrrrr_nous_base_urlrs 9.0F G GGr force_refreshrc ddlm}|ttjdd|}n3#t $r&}t d|Yd}~dSd}~wwxYwt| dpd  }t| d pd  d }|r|sdS||fS) a9Return fresh Nous runtime credentials when available. This mirrors the main agent's 401 recovery path and keeps auxiliary clients aligned with the singleton auth store + JWT refresh flow instead of relying only on whatever raw tokens happen to be sitting in auth.json or the credential pool. r resolve_nous_runtime_credentialsHERMES_NOUS_TIMEOUT_SECONDS15timeout_secondsrz7Auxiliary Nous runtime credential resolution failed: %sNrr:rrx) r rrrrrrrrrprjr)rrcredsrrrs r_resolve_nous_runtime_apirs DDDDDD00!"),I4"P"PQQ'     NPSTTTttttt%))I&&,"--3355G599Z((.B//5577>>sCCH (t H s36 A&A!!A&c : ddlm}m}td}|r|rk|}|Tt t|ddpt|ddpd}|tj dd d ptj d d d pt t|d dpd d pDt t|d dpd d | }|r|r||fSn2#t$r%}td|Yd}~nd}~wwxYw ddlm}|}n3#t$r&}td|Yd}~dSd}~wwxYwt |dpd}t |d pd d }|r|sdS||fS)aWResolve a fresh xAI OAuth (api_key, base_url) for auxiliary clients. Prefer the credential pool, matching the main runtime/provider status path. Some xAI OAuth logins live only as pool entries; falling straight to the singleton auth-store resolver would make auxiliary tasks such as compression report "no provider configured" even though ``hermes auth status`` shows xAI OAuth as logged in. Falls back to ``hermes_cli.auth``'s singleton runtime resolver for older auth-store-only logins. Returns ``None`` if the user is not authenticated with xAI Grok OAuth. r)DEFAULT_XAI_OAUTH_BASE_URL _xai_validate_inference_base_url xai-oauthNrrr:HERMES_XAI_BASE_URLrx XAI_BASE_URLrr)rz9Auxiliary xAI OAuth pool credential resolution failed: %s%resolve_xai_oauth_runtime_credentialsz>@@GGLLWy44::<<CCCHHW75*>sCCH (t H s0FF G 'GG G!! H+H  Hc&td\}}|rt|}|r|S ddlm}|}|di}|d}t |t r|sdS ddl}| dd}|d t| d zzz }tj | |} | d d} | r4tj| krtd | dSn#t"$rYnwxYw|S#t"$r&} td | Yd} ~ dSd} ~ wwxYw)aRead a valid, non-expired Codex OAuth access token from Hermes auth store. If a credential pool exists but currently has no selectable runtime entry (for example all pool slots are marked exhausted), fall back to the profile's auth.json token instead of hard-failing. This keeps explicit fallback-to-Codex working when the pool state is stale but the stored OAuth token is still valid. rhr)_read_codex_tokenstokensrNrrerrexpz-Codex access token expired (exp=%s), skippingz2Could not read Codex auth for auxiliary client: %s)rrr r(rpr"rrjrrmrrrrr2rrr) rrr r(rr)rrpayloadrr*rs r_read_codex_access_tokenr,gs-^<<L%%e,,  L666666!!##(B''zz.11 ,,, L4F4F4H4H 4  MMM"((--a0G ss7||ma/0 0GZ 8 8 A ABBF**UA&&C ty{{S(( LcRRRt    D !!###  I3OOOttttts=A$E B)D<;E < E E E  E F*F  Fc ddlm}m}n+#t$rtdYdSwxYw|D]\}}|jdkrt|rtd|=|dkr4 ddlm }|dsVn#t$rYnwxYwtcSt|\}}|rt|}|st||jp|j}t|} t!|pd } | td |j| |d kr$dd lm} m} | | r| || | fcSi} t+| drddi| d<nt+| drddlm}|| d<nft+| drt1| | d<nC ddlm}||}|r|jrt9|j| d<n#t:$rYnwxYwt=| d}|r|| d<tAd|| d | }tC|| ||}|| fcS||}tE|dd#}|s`tE|dd#$dp|j}t|} t!|pd } | td|j| |d kr$dd lm} m} | | r| || | fcSi} t+| drddi| d<nt+| drddlm}|| d<nft+| drt1| | d<nC ddlm}||}|r|jrt9|j| d<n#t:$rYnwxYwt=| d}|r|| d<tAd|| d | }tC|| ||}|| fcSdS)zTry each API-key provider in PROVIDER_REGISTRY order. Returns (client, model) for the first provider with usable runtime credentials, or (None, None) if none are configured. r)PROVIDER_REGISTRY$resolve_api_key_provider_credentialsz7Could not import PROVIDER_REGISTRY for API-key fallbackNNrz2Auxiliary api-key chain: %s is unhealthy, skippingrV)!is_provider_explicitly_configuredNz'Auxiliary text client: %s (%s) via poolrIris_native_gemini_base_urlrrrrclaude-code/0.1.0rapi.githubcopilot.com)copilot_default_headersrrr:rrxzAuxiliary text client: %s (%s)r)%r r.r/rrrrC auth_type_is_provider_unhealthyr1_try_anthropicrrrrrrr!rrr3r0hermes_cli.modelsr7rrrrrrrrprrrrjr)r.r/rpconfigr1rrr raw_base_urlrrvrr3extrar7_gpf_aux_ph_aux _merged_auxrr _gpf_aux2_ph_aux2 _merged_aux2s r_resolve_api_key_providerrEs [[[[[[[[[  NOOOzz!2 7 7 9 9aa W   ) )  !+ . .  LLM{ [ [ [  + % % MMMMMM88EE    !## # # #0== e & "+E22G 1%9STTrX_XrL*<88H/ <<DE} LLBGLRW X X Xh&&eeeeeeee,,X66Y--gQQQSXXXXXE$X~>> ,8:M+N'((&x1HII EEEEEE+B+B+D+D'((&x1KLL +CH+M+M'((JJJJJJ&h{33GQ7#:Q378O3P3P/0 D5eii@Q6R6RSSK 7+6'(IWxII5IIG+GUG\RRGE> ! ! !44[AAeii 2..//5577  599Z4455;;==DDSIIgWMg &|44+K88@D =  5w|UKKK ( " " a a a a a a a a((22 U))'HMMMuTTTT > : : (46I'JE# $ $ "8-D E E  A A A A A A'>'>'@'@E# $ $ "8-G H H '?'I'IE# $ $ GGGGGG$9[11N 8N/3H4L/M/ME+,    2599=N3O3OPP  4'3E# $E8EEuEE'NN~ :sB $33B!! B.-B.1H HH 1O<< P P explicit_api_keyctd\}}|r|pt|}|stdddSt|tpt}t dt||t|ptfS|ptj d}|stdddSt dt|tt|ptfS) Nrrrr0z%Auxiliary client: OpenRouter via poolrrrOPENROUTER_API_KEYzAuxiliary client: OpenRouter) rr_mark_provider_unhealthyrr/rrrr_OPENROUTER_MODELrr)rFrvrror_keyrs r_try_openrouterrNs,,\::L%W!A%:5%A%A  $\r : : : ::)%1DEE\I\ <===fx'7'9'9;;;#3#5#5 7 7 78=8RAR SSrctd\}}|r|dSt|sdSttjdpdsdSdS) z>Return a more precise OpenRouter auth failure reason for logs.rNzOOpenRouter credential pool has no usable entries (credentials may be exhausted)z=OpenRouter credential pool entry is missing a runtime API keyrJr:zOPENROUTER_API_KEY not setz&no usable OpenRouter credentials found)rrrrrrj)rrs r _describe_openrouter_unavailablerPsw,\::L%S =dd$U++ SRR ry-..4" 5 5 ; ; = =,++ 3 3rvisionc4 ddlm}|}|4|dkr.td|t d|dSn#t $rYnwxYwt }td}|/|s-td t dd dS||rtd d a td t} ddl m }||}|r#|}td|rdnd|n td|rdnd|n8#t $r+}td|rdnd||Yd}~nd}~wwxYw||\} } nt|pi} | s-tdt dd dSt|pidp t!d} t%| | |fS)Nr)nous_rate_limit_remainingz?Auxiliary: skipping Nous Portal (rate-limited, resets in %.0fs)rrHr0FrzSAuxiliary Nous client unavailable: no Nous authentication found (run: hermes auth).rzLAuxiliary Nous: runtime JWT refresh failed; checking stored auth.json token.TzAuxiliary client: Nous Portalget_nous_recommended_aux_modelrQz/Auxiliary/%s: using Portal-recommended model %srQrFz:Auxiliary/%s: no Portal recommendation, falling back to %szGAuxiliary/%s: recommended-models lookup failed (%s); falling back to %sz]Auxiliary Nous client unavailable: no usable inference JWT found (run: hermes auth add nous).rrxr4)agent.nous_rate_guardrSrrrKrrrrbr _NOUS_MODELr;rUrrrprrr) rQrS _remainingrruntimervrU recommendedrrrs r _try_nousr\*s  CCCCCC..00  !j1nn LLQ    %V < < < <:         D'e<<>>  MsSSS gt $ $ i 1266<<>>EEcJJ Y/44::<<  $###!   ++j))KY''J++j))K k3 ' ' {/@/@/B/B ##%%,,S11K[/::   j# & &'j.>.>.@.@'& k3 ' '{/@/@/B/B  ((**K 77s AAAc.t\}}}|pdS)Nr:)r)r|rts r_current_custom_base_urlr@s/11KA  "rc Dddlm}tdD]}ttj|pd}|sE ||}|jr|j }`#t$r}td|d|d|d}~wwxYwdS) aFail fast with a clear error when proxy env vars have malformed URLs. Common cause: shell config (e.g. .zshrc) with a typo like ``export HTTP_PROXY=http://127.0.0.1:6153export NEXT_VAR=...`` which concatenates 'export' into the port number. Without this check the OpenAI/httpx client raises a cryptic ``Invalid port`` error that doesn't name the offending env var. rr ) HTTPS_PROXY HTTP_PROXY ALL_PROXY https_proxy http_proxy all_proxyr:z%Malformed proxy environment variable rz1. Fix or unset your proxy settings and try again.N) urllib.parser r3rrrrprjschemeport ValueErrorrk)r rrrDrtrs r_validate_proxy_env_urlsrEs&%%%%%:  BJNN3''-2..4466   Xe__F} K   BBBeBBB    sA77 BBBcddlm}t|pd}|r|drdS ||}|jdvr |j}dSdS#t$r}td|d|d}~wwxYw) zEReject obviously broken custom endpoint URLs before they reach httpx.rrr:zacp://N>httphttpszMalformed custom endpoint URL: zJ. Run `hermes setup` or `hermes model` and enter a valid http(s) base URL.) rr rrjrlrrrrk)rr candidaterDrtrs r_validate_base_urlrbs%%%%%%HN##))++I  ,,X66)$$ =- - - AAA . -  Wi W W W   sA## B-BBct}t|dkr|\}}d}n|\}}}|r|sdS|trdSt pd}t d||pdt|\}}|rd|ini}td}|r||d<|dkr!td||d |} t| ||fS|d kre d d l m } | ||} n;#t$r.t d td||d ||fcYSwxYwt!| |||d|fStd||d |} t#| ||||} | |fS)Nrr0 gpt-4o-miniz3Auxiliary client: custom endpoint (%s, api_mode=%s)chat_completions default_queryrcodex_responsesr4rrru|Custom endpoint declares api_mode=anthropic_messages but the anthropic SDK is not installed — falling back to OpenAI-wire.Frr)rrrkrl_CODEX_AUX_BASE_URLrgrrrGrrrrrrrbrr) rZr|r}r~rv _clean_base_dq_extra_custom_headersrr_fallback_clients r_try_custom_endpointrts9%''G 7||q") Z /6, Z jz%%&9&?&?&A&ABBz    /-E LLF{Op^pqqq0==K'* 2os # #F 2$77O4$3 !'''PZ+PPPP #K77>>*** U F F F F F F00[IIKK U U U NNR   M*{MMfMMuT T T T  U %[%[[` a a a   Qj;QQ&QQ,%[+ U ""sD5E  E c|stddSt}|dS|\}}td|t ||}t |||fS)u Build a CodexAuxiliaryClient for an xAI Grok OAuth-authenticated session. xAI's ``/v1/responses`` endpoint speaks the OpenAI Responses API, so we wrap a plain ``OpenAI`` client in ``CodexAuxiliaryClient`` to translate ``chat.completions.create()`` calls into ``responses.stream()`` requests. The caller must pass an explicit model — pinning a default for Grok would silently rot when xAI's allowlist drifts. Returns ``(None, None)`` when the user has not authenticated with xAI Grok OAuth. zuAuxiliary client: xai-oauth requested without a model; pass model explicitly (auxiliary..model in config.yaml).r0Nz2Auxiliary client: xAI OAuth (%s via Responses API)r4)rrbr&rrr)rvresolvedrrrs r_build_xai_oauth_aux_clientrs  M   z)++Hz GX LLEuMMM8<<.model`` config). Returns (None, None) when no Codex OAuth token is available. zxAuxiliary client: openai-codex requested without a model; pass model explicitly (auxiliary..model in config.yaml).r0rhz4Auxiliary client: Codex OAuth (%s via Responses API)rI) rrbrrrrr,rrrr)rvrr codex_tokenrrs r_build_codex_clientrs  M   z,^<<L% '+E22  +-e5HII`M`HH244K "!z*HH.00  :& LLGOOO1+>>K U 3 3U ::rrvrFexplicit_base_urlrrcl ddlm}ddlm}ddlm}n#t $rYdSwxYw |}t|tr| dni}t|tsi}n#t$ri}YnwxYw |d||||} n\#|$r&} t d | Yd } ~ dSd } ~ wt$r&} t d | Yd } ~ dSd } ~ wwxYw| d } t| d dpd} |p| dpd} t| st| nd}|r| sdSt!|p#t| dpdd}|s1t d|| ddSi}t#| \}}|r||d<t%d| |d|}| dkrt'|||fS| dkrt)||| | | |fS||fS)uResolve an Azure Foundry auxiliary client via the runtime resolver. Mirrors the ``_try_anthropic`` / ``_try_nous`` shape but delegates to :func:`hermes_cli.runtime_provider._resolve_azure_foundry_runtime` — the same resolver the main agent uses — so: * ``auth_mode: api_key`` (default) gets the static ``AZURE_FOUNDRY_API_KEY`` string. * ``auth_mode: entra_id`` gets a callable bearer-token provider (``Callable[[], str]`` from :mod:`agent.azure_identity_adapter`). * Per-model ``api_mode`` auto-routing for GPT-5.x / o-series / codex models works. * ``model.entra.{tenant_id,client_id,authority,scope}`` config fields propagate. * Non-default ``model.base_url`` overrides are honored. The OpenAI SDK accepts both shapes for ``api_key`` so the caller can forward the result without coercion. Returns ``(client, model)`` or ``(None, None)`` on failure. r)_resolve_azure_foundry_runtime) AuthErrorrr0rv azure-foundry)requested_providerrfrFr target_modelzAuxiliary azure-foundry: %sNz)Auxiliary azure-foundry runtime error: %srrr:rrTr@zAAuxiliary azure-foundry: no model resolved (model=%r, default=%r)rr4rrr)ryrr rrrrr"rrprrrrrr_normalize_resolved_modelrGrrr)rvrFrrrrrrerfrZrrrruntime_api_mode_has_key final_modelr>rrclients r_try_azure_foundryrs:NNNNNN------1111111 zzkmm(23(=(=ECGGG$$$2 )T** I   00.-/      2C888zzzzz  @#FFFzzzzzkk)$$G7;;z2..4"55HP7;;z#:#:P>P %-W$5$5?tG}}}4H 8z+ 4Y]]9--344K   O 9==++   z E0::K %!$o  CGk C CU C CF,,,$FK88+EE/// % K &     ; sB ##A A55 BBBC2B?? C2 C--C2c ddlm}m}n#t$rYdSwxYwt d\}}|r|dS|pt |}nd}|p |}|sdS|rt |tnt} ddlm }|}| d} t| trt| dpd} | dkr@| d pdd } | r| }n#t"$rYnwxYwdd lm} | |} t'dpd }t(d |||  |||}n#t$rYdSwxYwt-||||| |fS)Nr)rresolve_anthropic_tokenr0rVrrvr`r:rrx)_is_oauth_tokenrz8Auxiliary client: Anthropic native (%s) at %s (oauth=%s)r)rrrrrrr_ANTHROPIC_DEFAULT_BASE_URLrrrpr"rrrjrkrrrrrrr)rFrrrrr rrrerf cfg_provider cfg_base_urlrrrvrs rr:r:\sZ[[[[[[[[[ zz-[99L%> =: @$9%$@$@ =$;$;$=$= z NZz%e-HIII_zH  111111kmmGGG$$ i & & ,y}}Z88>B??EEGGMMOOL{** ) j 9 9 ?RFFHHOOPSTT ,+H      877777u%%H ' 4 4 S8SE LLKUT\^fggg,,UH== zz  $KxRZ [ [ []b bbs1 7CE E  E  F F+*F+rr local/customapi-keyrNr\rrE)r`rvrrr auth_mode main_runtimect|tsiSi}tD]}||}|dkr*t |rt|t s|||<Gt|t r+|r|||<|d}t|t r||d<|S)uReturn a sanitized copy of a live main-runtime override. Most fields are stripped strings. ``api_key`` may legitimately be a zero-arg callable (Azure Foundry Entra ID token provider) — preserve those as-is so auxiliary clients inherit the same authentication surface as the main agent. The OpenAI SDK accepts ``Callable[[], str]`` for ``api_key`` and calls it before every request. rr`)r"r_MAIN_RUNTIME_FIELDSrprrrjrk)rrqfieldrr`s r_normalize_main_runtimers lD ) ) !#J%..  '' I  (5// *UC:P:P  %Ju   eS ! ! .ekkmm . % Ju ~~j))H(C  2!)!1!1 : rcFdtfdtfdtfdtfgS)aBReturn the ordered provider detection chain. Built at call time (not module level) so that test patches on the ``_try_*`` functions are picked up correctly. NOTE: ``openai-codex`` is deliberately NOT in this chain. The ChatGPT-account Codex endpoint only accepts a shifting, undocumented allow-list of model IDs, so falling back to it with a guessed model fails more often than not. Codex is used only when the user's main provider *is* openai-codex (see Step 1 of ``_resolve_auto``) or when a caller explicitly requests it with a model. rrrrrrrr_get_provider_chainrs0 '  -. -.  rX_aux_unhealthy_until_aux_unhealthy_logged_atrh)rrrfrrhrgc|sdSt|}t||S)a Normalize a resolved_provider value to a chain label used by ``_get_provider_chain()``. Falls back to the lowercased input for direct API-key providers (deepseek, alibaba, minimax, etc.) which each report their own provider name from the api-key chain. r:)rrjrk_AUX_UNHEALTHY_LABEL_ALIASESrp)r`ps r_normalize_chain_labelrsJ r H ##%%A ' + +Aq 1 11rrc .t|}|sdStj||ntz}|t|<td|t ||nttjdtj|dS)zMark ``provider`` as recently-402'd, hidden from chain iteration until the TTL expires. Called from the payment-fallback branches in ``call_llm`` and ``acall_llm`` after a confirmed payment error. NzsAuxiliary: marking %s unhealthy for %ds (payment / credit error). Subsequent auxiliary calls will skip it until %s.z%H:%M:%S) rr2_AUX_UNHEALTHY_TTL_SECONDSrrrbrstrftime localtime)r`rlabelr s rrKrKs #8 , ,E s*?*?#@#@     rcjttdS)zvClear the unhealthy cache. Used by tests and by a future explicit user trigger (e.g. ``hermes config aux reset``).N)rclearrrrr_reset_aux_unhealthy_cacher) s.   ""$$$$$rrct|dd}|dkrdSt||dvrtfddDrdSdS) u Detect payment/credit/quota exhaustion errors. Returns True for HTTP 402 (Payment Required) and for 429/other errors whose message indicates billing exhaustion or daily quota exhaustion rather than transient rate limiting. Daily token quota errors (e.g. Bedrock "Too many tokens per day", Vertex AI "quota exceeded") are functionally equivalent to credit exhaustion — the provider cannot serve the request until the quota resets — and should trigger the same provider-fallback logic. status_codeNT>Nrc3 K|]}|vV dSrrr>kw err_lowers r z$_is_payment_error..E s7  2rY      r)creditsinsufficient fundscan only affordbillingpayment required out of fundsrun out of fundsbalance_depletedno usable credits model_not_supported_on_free_tiernot available on the free tierzquota exceededquota_exceededztoo many tokens per dayz daily limitztokens per dayz daily quotazresource exhaustedzweekly usage limitz weekly limitFrrrkanyrstatusrs @r_is_payment_errorr0 sS- . .F }}tC  I &&&     *       4 5rc ddlm}|d}|jduS#t$r&}td|Yd}~dSd}~wwxYw)zMReturn True only when the fresh Nous account API says paid access is allowed.r)get_nous_portal_account_infoT) force_freshz8Auxiliary Nous paid-entitlement refresh check failed: %sNF)hermes_cli.nous_accountrpaid_service_accessrrr)r account_infors r*_nous_portal_account_has_fresh_paid_accessrX s|HHHHHH33EEE /477  OQTUUUuuuuus A AA c t|dd}t|t|jdkrdS|dkr:t fddDrdSt fdd DsdSd S) aHDetect rate-limit errors that warrant provider fallback. Returns True for HTTP 429 errors whose message indicates rate limiting (as opposed to billing/quota exhaustion, which _is_payment_error handles). Also catches OpenAI SDK RateLimitError instances that may not set .status_code on the exception object. rNRateLimitErrorTrc3 K|]}|vV dSrrrs rrz'_is_rate_limit_error..w s7  2rY      r) rate limit rate_limitztoo many requestsz try againz retry afterz resets inc3 K|]}|vV dSrrrs rrz'_is_rate_limit_error..} s7  r2?      r) rrrrrrrrrrrF)rrrkr$r(rrs @r_is_rate_limit_errorrd sS- . .FC  I Cyy---t }}     *       4    .       4 5rcD ddlm}m}t|||frdSn#t$rYnwxYwt |jtfddDrdSt| tfddDrdSdS) aEDetect connection/network errors that warrant provider fallback. Returns True for errors indicating the provider endpoint is unreachable (DNS failure, connection refused, TLS errors, timeouts). These are distinct from API errors (4xx/5xx) which indicate the provider IS reachable but returned an error. r)APIConnectionErrorAPITimeoutErrorTc3 K|]}|vV dSrr)r>rerr_types rrz'_is_connection_error.. s' L Lb2> L L L L L Lr) ConnectionTimeoutDNSSSLc3 K|]}|vV dSrrrs rrz'_is_connection_error.. s7  r2?      r) zconnection refusedzname or service not knownzno route to hostznetwork is unreachablez timed outzconnection resetzincomplete chunked readzpeer closed connectionzresponse ended prematurelyzunexpected eofremoteprotocolerrorlocalprotocolerrorF) rrrr"rr$r(rrrk)rrrrr s @@r_is_connection_errorr s >>>>>>>> c.@ A A 4       Cyy!H L L L L$K L L LLLtC  I     &   t 5s ! ..ct|rdSt|ddptt|dddd}t|to|dkpd|cxkodkncS)a-Return True for a one-off transport blip worth retrying ONCE on the same provider before any provider/model fallback. Covers connection/streaming-close errors (via the canonical ``_is_connection_error`` detector, shared so the two cannot drift) plus a pure 5xx/408 HTTP status. Deliberately narrow: this is the "retry the same target once" gate, distinct from ``_is_payment_error`` / ``_is_auth_error`` / ``_is_rate_limit_error`` which the except-chain handles by switching provider, refreshing creds, or rotating the pool. TrNriir)rrr"r)rrs r_is_transient_transport_errorr sC  t S- . .'Z&& t33F fc " " M# (L9L9L9L9L9L9L9L9LMrct|dd}|dkrdSt|}d|vs(dt|jvrdS|dkrd|vrdSd |vrd|vrdSd S) zCDetect auth failures that should trigger provider-specific refresh.rNTzerror code: 401authenticationerrorizbad-credentialsunauthenticatedF)rrrkr$r(rs r_is_auth_errorr s S- . .F }}tC  II%%)>$s))BTBZBZB\B\)\)\t}}*i77tI%%*;y*H*Ht 5rparamc|pd}|sdSt||vrdStfddDS)a/Detect provider 400s for an unsupported request parameter. Different OpenAI-compatible endpoints phrase the same class of error a few ways: ``Unsupported parameter: X``, ``unsupported_parameter`` with a ``param`` field, ``X is not supported``, ``unknown parameter: X``, ``unrecognized request argument: X``. We match on both the parameter name and a generic "unsupported/unknown/unrecognized parameter" marker so call sites can reactively retry without the offending key instead of surfacing a noisy auxiliary failure. Generalizes the temperature-specific detector that originally shipped with PR #15621 so the same retry strategy can cover ``max_tokens``, ``seed``, ``top_p``, and any future quirk. Credit @nicholasrae (PR #15416) for the generalization pattern. r:Fc3 K|]}|vV dSrr)r>markerrs rrz2_is_unsupported_parameter_error.. s8  vv"      r)zunsupported parameterunsupported_parameterz not supportedzdoes not supportzunknown parameterzunrecognized request argumentzunrecognized parameterzinvalid parameter)rkrr)rr param_lowerrs @r_is_unsupported_parameter_errorr  s ;B%%''K uC  I)##u      2      rc"t|dS)zBack-compat wrapper: detect API errors where the model rejects ``temperature``. Delegates to :func:`_is_unsupported_parameter_error`; kept as a separate public symbol because existing tests and call sites import it by name. r)r )rs r!_is_unsupported_temperature_errorr" s +3 > >>rct|dd}t|tfddDrdS|dvrdStfddDS) u!Detect "the requested model doesn't exist" errors (404 / invalid model). This fires when a resolved model name is no longer served by the endpoint — most commonly when a long-lived process pinned a Portal-recommended model that has since been dropped from the Nous → OpenRouter catalog. The Nous proxy returns 404 with a body like:: Model 'gpt-5.4-mini' not found. The requested model does not exist in our configuration or OpenRouter catalog. Distinct from :func:`_is_payment_error` (which also matches some 404s for free-tier/credit language) — this one keys on "does not exist / not found / not a valid model" phrasing, and explicitly excludes the billing keywords that the payment path already owns so the two predicates don't overlap. rNc3 K|]}|vV dSrrrs rrz,_is_model_not_found_error.. s7  r2?      r) rrrrrrz free tierz free-tierrF>Nrc3 K|]}|vV dSrrrs rrz,_is_model_not_found_error.. s7  2rY      r) zmodel does not existz#does not exist in our configurationzopenrouter catalogzis not a valid modelz no such modelzmodel not foundz the model `model_not_foundz unknown modelrrs @r_is_model_not_found_errorr( s S- . .FC  I     &    u %%%u      *      rct|t5fdtD}|D]}t|dd}|Kt | t |dd}t |r |n#t$rYnwxYwt|d ddddS#1swxYwYdS)zEDrop cached auxiliary clients for a provider so fresh creds are used.c`g|]*}tt|dk(|+Sr=)rtr)r>rrqs r z)_evict_cached_clients..+ s@   &s3q6{{33zAA AAArrvrNr)) rt_client_cache_lock _client_cacherp_force_close_async_httpxrrrr)r` stale_keysrrr~rqs @r_evict_cached_clientsr0' sR(22J ))    (    ) )C"&&s,>??BF!(000&vw==H))#   D   c4 ( ( ( ( ) ))))))))))))))))))s6A C#*B C BCBCC C targetc:|dSd}t5ttD]M}t|}||d}|*t |dd}||us||ur t|=d}N dddn #1swxYwY|S)u@Drop the cache entry whose stored client is *target*. Used when a specific cached client has been poisoned (closed httpx transport after a timeout, broken streaming session, etc.) so the next auxiliary call rebuilds rather than reusing the dead instance. Walks both sync and async wrappers (``CodexAuxiliaryClient``, ``AnthropicAuxiliaryClient``, ``AsyncCodexAuxiliaryClient``, etc.) via their ``_real_client`` attribute so a timeout that closes the underlying ``OpenAI`` (or native provider) client evicts every cached shim that exposed it. Async wrappers must mirror their sync sibling's ``_real_client`` for this to work — otherwise the sync entry is evicted but the async entry survives and keeps reusing the dead transport. Returns True when at least one entry was evicted. NFrrT)r,rar-keysrpr)r1evictedrrcachedreals rr-r-< s"~uG    **,,--  C!%%c**E}1XF~6>488D46>>!#&                 NsA5BBBrcVt|}|dkr?t|}t|dp t}|dvrdSt |}|dSt t |ddpd}|sdS|d|S)z9Return a stable cache discriminator for pooled providers.rbr`>r:rbrfr:NrKrd)rtrrprnrrrrj)r`rrqrZrentry_ids r_pool_cache_hintr:_ s )22JV),77,W[[-D-D-]H[H]H]^^ +++r Z ( (E }r75$++1r2288::H r % %8 % %%rcXt|dd}dt|i}|||d<|S)NrrE)rr)rrr+s r_pool_error_contextr<t s8 S- . .F(#c((3G !'  Nrresolved_providerrct|}|dvr|Stt|ddpd}t|drdSt|drdSt|drd St|d rd St|d rd St|drdSt|drdS|rt |}|dd}|r|dvr ddlm}||}|rit|dddkrTtt|ddpdd} | rt|t| r|Sn#t$rYnwxYwdS)zCInfer which provider pool can recover the current auxiliary client.>r:rbrfrr:z chatgpt.comrhrwrinference-api.nousresearch.comrrrVr6rWrrPzapi.x.air!r`r)r.r8Nrrrx) rtrrr0rrpr r.rr1r) r=rrrqbasert rt_providerr.r<rt_bases r_recoverable_pool_providerrD| s )):;;J/// wvz2..4" 5 5DT=11~T?33|T#CDDvT#677{T#:;;yT>22}T:..{  $\ 2 2ffZ,,  ;.DDD ======+// <<+ww TBBiOO!''3G"L"L"RPRSSZZ[^__G+#8?PQX?Y?Y#Z#Z+**     4s"BE)) E65E6failed_api_keyrFct|} t|}n4#t$r'}td||Yd}~dSd}~wwxYw|r|sdSt |dd}t|}|pd}t|rX| } | t|dS| ||nd||} | t|dSdSt|st|rBt|rdnd } | ||n| ||} | t|dSdS) avTry same-provider credential-pool recovery for auxiliary calls. ``failed_api_key`` is the API key that was actually used for the failing request. Passing it lets mark_exhausted_and_rotate identify the correct pool entry even when another process has already rotated the pool (which would leave current() as None, causing the wrong entry to be marked). z9Auxiliary client: could not load pool for %s recovery: %sNFrTr)r error_context api_key_hintrr)rtr-rrrrrr<rtry_refresh_currentr0mark_exhausted_and_rotaterr) r`rrFrqrload_excrrHhint refreshed next_entryfallback_statuss r_recover_provider_poolrQ s)22J$$  PR\^fggguuuuu t++--u#}d33K',,M  !TDc ,,..  !* - - -433'2'> C'4   ! !* - - -4u !5c!:!: !23!7!7@##S33'2'> O'4   ! !* - - -4 5s! AA  Aresolved_modelresolved_base_urlresolved_api_keyresolved_api_moderr rrreffective_timeouteffective_extra_bodyc |dkrt||||d\}}}nt||||||\}}|td|pdd|dtt |d d pd }t ||p||| | | | | |p| }t ||rt|d |d <t|j j j d i||S)NrQFr`rvrr async_moderrrr Auxiliary r : provider $ could not be rebuilt after recoveryrr:rrrrrrr r resolve_vision_provider_client_get_cached_clientrkrr_build_call_kwargs_is_anthropic_compat_endpoint#_convert_openai_images_to_anthropic_validate_llm_responserrrj)rr=rRrSrTrUrrr rrrrVrWrt retry_client retry_model retry_base retry_kwargss r_retry_same_provider_syncrk sU" x'E&&$ ( ( ( $<%7  &$&% % % % ! k k k k4E k k k   W\:r::@bAAJ%"{!'00   L%%6 CCa#F|T^G_#`#` Z !, %,<<|<> u !* - - -4    H H H H H H44 %bi0Mt&T&T U U"EuyyB//5266<<>> u !* - - -4  $ $ { { { { { { { { { {0022E3=eT3J3JruyyYgOhOhr((///nrEu{##))++ 2//11u{##))++ u !* - - -4  $ $Z((D ,,..   4466 (SDUWY1Z1Z1`^`-a-a-g-g-i-i()*5554 M M M M M M99MMMEuyyB//5266<<>> u !* - - -4# %$  NPZ\_```uuuuu 5sLAJ"J3A0J%J6B!JJ*BJA J J K)K  K payment errorfailed_providerreasonc  |}t}|h}|r=||vr'||ddddddd fd|D}g}t D]\}} ||vr t |r)t ||||dB| \} } | *t d |pd |||| pd | | |fcS||t d |pd ||d |dS)zTry alternative providers after a payment/credit or connection error. Iterates the standard auto-detection chain, skipping the provider that failed. Returns: (client, model, provider_label) or (None, None, "") if no fallback. rrrhr)rrrhrgrfrc<h|]}||Srrp)r>s_alias_to_labels r z(_try_payment_fallback.. s)HHHq,,Q22HHHr (unhealthy)Nu2Auxiliary %s: %s on %s — falling back to %s (%s)rr@zrerrorcFtpd}tpd}|r|r|dvrdS|pd}||krdSt |rt ||dS t ||\}}n#t$rd\}}YnwxYw|dSd|d}t d |pd ||||p|||p||fS) aLast-resort fallback to the user's main agent provider + model. Used after the configured fallback_chain is exhausted (or empty) for users with an explicit auxiliary provider. This is the "safety net" layer: if nothing the user asked for can serve the request, try the main chat model before giving up. Skips when the failed provider already IS the main provider (no point retrying the same backend that just failed). Returns: (client, model, provider_label) or (None, None, "") if no fallback. r:>r:rbrr`rvr0Nz main-agent()uCAuxiliary %s: %s on %s — falling back to main agent model %s (%s)r) rnrjrgrkr9rresolve_provider_clientrrr) rvrrwr main_modelrrrRrs r_try_main_agent_model_fallbackr sv$)**0b7799M"$$*1133J  m.A.A.C.C|.S.S~  !r ( ( * * 0 0 2 2D$$~m,,M4000~,!8"*" " "  ,,,!+,~~ *- * * *E KKM 8T* >/Z 66sCC,+C,c Z|sdSt|}|d}|rt|tsdS|}g}t |D]\}}t|tst|dd} | r| |krlt|ddpd} t|ddpd} t|ddpd} d |d | d } t| | | | }n#t$rd}YnwxYw|(t d |||| | pd || | fcS| | |r/td|d|dS)agTry user-configured fallback_chain for a specific auxiliary task. Reads auxiliary..fallback_chain from config.yaml and tries each entry in order. Each entry must have at least ``provider``; ``model``, ``base_url``, and ``api_key`` are optional. Returns: (client, model, provider_label) or (None, None, "") if no fallback. rfallback_chainr`r:rvNrrzfallback_chain[z](ru9Auxiliary %s: %s on %s — configured fallback to %s (%s)r@z=Auxiliary %s: configured fallback_chain exhausted (tried: %s)r)_get_auxiliary_task_configrpr"rarkrj enumeraterr_resolve_single_providerrrrr]rrm)rrvrw task_configchainrrir fb_providerfb_model fb_base_url fb_api_keyr fb_clients r_try_configured_fallback_chainr s] ~,T22K OO, - -E  5$//~  " " ( ( * *D Ee$$5%&&  %))J3344::<<  k//11T99 uyy"--..4466>$%))J3344::<<D 9b112288::Bd 5!55{555 0X{J@@II   III   KKKfouh6K)   h- - - - U   K $))E""    >sF'' F65F6c2t||||\}}|S)zResolve a single provider entry from fallback_chain to an OpenAI client. Uses the existing provider resolution infrastructure where possible. )r`rvrr)r)r`rvrrrrRs rrr$ s05 FN Mrc hdat|}|dd}t|dpd}t|dpd}|dd}t|dpd}|strt}|st rt }|st rt }tsttj dd }|p t}|r;|r9|d kr3| d std ||d at|ptpd} t|ptpd} | r| r| d vr| } d} d} |r$| d ks| d r d } |} |pd} n|r|} t!| }|rt#|rt%|n?t'| | | | |pd\}}|$td| |p| ||p| fSg}t+D]\}}t#|r(t%|||d<|\}}|Y|r3td||pdd|ntd||pd||fcS||tdd|dS)uFull auto-detection chain. Priority: 1. User's main provider + main model, regardless of provider type. This means auxiliary tasks (compression, vision, web extraction, session search, etc.) use the same model the user configured for chat. Users on OpenRouter/Nous get their chosen chat model; users on DeepSeek/ZAI/Alibaba get theirs; etc. Running aux tasks on the user's picked model keeps behavior predictable — no surprise switches to a cheap fallback model for side tasks. 2. OpenRouter → Nous → custom → Codex → API-key providers (fallback chain, only used when the main provider has no working client). Fr`r:rvrrrrtrfrczOPENAI_BASE_URL is set (%s) but model.provider is '%s'. Auxiliary clients may route to the wrong endpoint. Run: hermes model to reconfigure, or remove OPENAI_BASE_URL from ~/.hermes/.envT>r:rbN)rrFrz2Auxiliary auto-detect: using main provider %s (%s)r~u4Auxiliary auto-detect: using %s (%s) — skipped: %sr@rz$Auxiliary auto-detect: using %s (%s)zAuxiliary auto-detect: no provider available (tried: %s). Compression, summarization, and memory flush will not work. Set OPENROUTER_API_KEY or configure a local model in config.yaml.r0)rrrprrjrkrl_stale_base_url_warnedrrrjrnrlrrbrgrr9rrrrr]rm)rrZruntime_provider runtime_modelrrr _env_base _cfg_providerrrr=rrFmain_chain_labelrrrrrrvs r _resolve_autor7 s%l33G{{:r22 G,,233M7;;z228b99kk)R00O7;;z228b99 2 621 040/ 2 621 " *I/44::<< (A,?,A,A  *- *!X--%00;;. NN6=    &* "(G,?,A,AGRHHM]>&6&8&8>B??J!6*!6\11)   /(!:!:m>V>VW`>a>a!: (  0 .6$    / /  22CDD  6 67G H H 6  0 1 1 1 16!"3!1)1T     FH! P)8+AzCCCx5:55 E,..   v !% ( (   & & & LLE/// 0 0 0     _ R!5#5Ityy7G7GIIII BE5K]T]^^^5=  U NNW99U##%%% :r is_visioncddlm}t|trt ||fSt|t rt ||fS ddlm}m }t||r |||fSn#t$rYnwxYw ddl m }t||r||fSn#t$rYnwxYw|j t|jd}t|j}t!|drt#|d<nt!|drdd lm} | d | |d<nt!|d rd di|d<nyt!|drt)||d<nV ddlm} ddlm} | |} | r+| | } | r| jrt5| j|d<n#t6$rYnwxYwt9|d}|r||d<|di||fS)aaConvert a sync client to its async counterpart, preserving Codex routing. When ``is_vision=True`` and the underlying base URL is Copilot, the resulting async client carries the ``Copilot-Vision-Request: true`` header so the request is routed to Copilot's vision-capable infrastructure (otherwise vision payloads silently time out). r) AsyncOpenAI)rAsyncGeminiNativeClientrr4rwrr6copilot_request_headersT is_agent_turnrrrr5r)_infer_provider_from_urlrr)rrr"rrrrrrrrrrrrrr0rhermes_cli.copilot_authrragent.model_metadatarrrrrrrrp) sync_clientrvrrrrr async_kwargs sync_base_urlrr _gpf_async _inferred _ph_async _merged_asyncs r_to_async_clientr s#"""""+344=(55u<<+788A,[995@@ [[[[[[[[ k#5 6 6 ?**;77> > ?       ====== k#3 4 4 &% % &      & ,--L ,--M]O<<*:*<*< &'' }.E F FCCCCCC*A*A)+ + + &'' }n = =+79L*M &'' }.H I I*B=*Q*Q &''  E E E E E E D D D D D D00??I V&Jy11 V!:V6:9;T6U6UL!23    D / 0@0@AR0S0STTM8*7 &' ; & & & & --s7$A:: BB B&& B32B3+AF00 F=<F= model_namecT|s|S ddlm}|||S#t$r|cYSwxYw)zANormalize a resolved model for the provider that will receive it.r)normalize_model_for_provider)hermes_cli.model_normalizerr)rr`rs rrr sa KKKKKK++JAAA s  ''rZ raw_codexc (#Jt|pd} t|}|st |pt p|}dt dt dtffd J djdt dt dt fJfd } |d kr]t| \} } | d S|r(d |vr$| r"d | vrt d|| d }|p| } |rt| | |n| | fS|dkrht|\} }| )t dtd St|p||} |rt| | |n| | fS|dkr|t vp+|pddk}t%|\} }| t dd St|p||} |rt| | |n| | fS|dkr|st dd Srdt'}|st dd St||} t)|t*t-|}|| fSt/|\} }| t dd St|p||} |rt| | |n| | fS|dkrZt1|\} }| t dd St|p||} |rt| | |n| | fS|dkr|rt3|}|pdp(t5jddpd}|st d d St|p|r|d!nd pd"|} i}t;|\}}|r||d#<t=|d$rd%d&i|d'<nt=|d(rd)d*lm }|d+|,|d'<nft=|d-rtC||d'<nC d)d.l"m#}||}|r|j$rtK|j$|d'<n#tL$rYnwxYwtO|d'}|r||d'<t)dk||d/|} | | | ||} |rt| | |n| | fStPtRfD]}|\} }| t|p||} t tU| d0dpd}tU| d1d}tW|rtY|t sdnt |pd}| | | ||} |rt| | |n| | fcSt d2d S d)d3l-m.}d } | r| |kr || } | ||} | rT| d0d}| d1d}| d4p| d5pd}!|s)|!r't5j|!d}|pd}|dkr0t d6| d7p|p| d8pd}"|rt|p=| d!p(|r|d!nd pt pd"|} |"d9kr|}#|}$nt3|}#|}$t;|#\}%}&|&rd#|&ini}'tO|'d'}(|(r|(|'d'<t d:|| |"pd;|"d9kr d)d?}0|rtg|0| fS|0| fSt)dk||%d/|'} |"d@kr&tY| thsti| | } n| | | |$|} |rt| | |n| | fSt dA|d Sn#tb$rYnwxYw|dBkr^tk|||C\} }1| t dDd St|p|1|} |rt| | |n| | fS d)dEl6m7}2m8}3m9}4n,#tb$rt dF|Yd SwxYw|2|}5|5t dG|d S|5j:d1kr|dHkr[tw|\} }1| t dId St|p|1|} |rt| | |n| | fS|3|}6t |6d1d}7|r|p|7}7|7s`ty|5j=}8|dJkr|8>dKt dL|dM?|8d St |6d0d@d p|5jA}9t3|9}:|r4t3|@d }:t |}1t|p|1|} |dNkrTd)dOlBmC};mD}<|<|:rA|;|7|:/} t dP|| |rt| | |n| | fSi}=t=|:d$rd&|=d%<nt=|:d(r'd)d*lm }|=E|d+|,nyt=|:d-r#|=EtC|:nF d)d.l"m#}>|>|}?|?r!|?j$r|=E|?j$n#tL$rYnwxYwtO|=}@|@r|@}=t)dk|7|:d/|=rd'|=ini} |dJkrR| rPsN d)dQlFmG}A|A| r+t dR| ti| | } n#tb$rYnwxYw| | | |9|7} t dP|| |rt| | |n| | fS|5j:dSkr|4|}6t|p&|r|d!nd p t |} |dTkrLt |6d1d}7t |6d0d}:t |6dUdpd }Bty|6dVpg}C| st dWd S|7r|:st dXd Sd)dYlHmI}D|D|7|:|B|CZ} t dP|| |rt| | |n| | fSt d[|d S|5j:d\kr d)d]lJmK}EmL}Fd)d^l/mM}Gn+#tb$rt d_Yd SwxYw|Est d`d S|F}Hda}1t|p|1|} |G|H}*n3#tb$r&}It db|IYd }I~Id Sd }I~IwwxYwte|*| dcdd|Hde/} t df| |H|rt| | |n| | fS|5j:dgvrb|dkrtd||S|dkrtd||S|dkrtd||St dh|d St di|5j:|d S)luCentral router: given a provider name and optional model, return a configured client with the correct auth, base URL, and API format. The returned client always exposes ``.chat.completions.create()`` — for Codex/Responses API providers, an adapter handles the translation transparently. Args: provider: Provider identifier. One of: "openrouter", "nous", "openai-codex" (or "codex"), "zai", "kimi-coding", "minimax", "minimax-cn", "custom" (OPENAI_BASE_URL + OPENAI_API_KEY), "auto" (full auto-detection chain). model: Model slug override. If None, uses the provider's default auxiliary model. async_mode: If True, return an async-compatible client. raw_codex: If True, return a raw OpenAI client for Codex providers instead of wrapping in CodexAuxiliaryClient. Use this when the caller needs direct access to responses.stream() (e.g., the main agent loop). explicit_base_url: Optional direct OpenAI-compatible endpoint. explicit_api_key: Optional API key paired with explicit_base_url. api_mode: API mode override. One of "chat_completions", "codex_responses", or None (auto-detect). When set to "codex_responses", the client is wrapped in CodexAuxiliaryClient to route through the Responses API. Returns: (client, resolved_model) or (None, None) if auth is unavailable. r: base_url_str model_strrct|trdSrdSdkrdSrdkrdSt|dkr|pd}d|vrdSdS)a(Decide if a plain OpenAI client should be wrapped for Responses API. Returns True when api_mode is explicitly "codex_responses", or when auto-detection (api.openai.com + codex-family model) suggests it. Already-wrapped clients (CodexAuxiliaryClient) are skipped. FrTapi.openai.comr:rg)r"rr1rk)rrr model_lowerrrs r_needs_codex_wrapz2resolve_provider_client.._needs_codex_wrapW s j"6 7 7 5  5 ( ( (4  $5555 \ * *.> > >$?1133K+%%turfinal_model_str api_key_strc|||r;tdpd||r |ddndt||St||||S)a@Wrap a plain OpenAI client in the correct transport adapter. Handles two cases: - ``CodexAuxiliaryClient`` when the endpoint needs the Responses API (explicit ``api_mode=codex_responses`` or api.openai.com + codex model name). - ``AnthropicAuxiliaryClient`` when the endpoint speaks Anthropic Messages (explicit ``api_mode=anthropic_messages``, any ``/anthropic`` suffix, ``api.kimi.com/coding``, or ``api.anthropic.com``). Clients that are already specialized wrappers pass through unchanged. zeresolve_provider_client: wrapping client in CodexAuxiliaryClient (api_mode=%s, model=%s, base_url=%s)rNrr:)rrrr)rrrrrrs r_wrap_if_neededz0resolve_provider_client.._wrap_if_neededm s  Z G G E LL7+O_%19 SbS!!r  ; ; ; ( ODD D% lH   rrbr7Nr0rxz\Dropping OpenRouter-format model %r for non-OpenRouter auxiliary provider (using %r instead)rr)rFz4resolve_provider_client: openrouter requested but %srz mimo-v2-omnirVzYresolve_provider_client: nous requested but Nous Portal not configured (run: hermes auth)rhzresolve_provider_client: openai-codex requested without a model; pass model explicitly (e.g. model.model in config.yaml or auxiliary..model for per-task aux routing).zbresolve_provider_client: openai-codex requested but no Codex OAuth token found (run: hermes model)rIr!uresolve_provider_client: xai-oauth requested but no xAI OAuth token found (run: hermes model -> xAI Grok OAuth — SuperGrok / Premium+)rfrurxzQresolve_provider_client: explicit custom endpoint requested but base_url is emptyrvrrrrr5rr6rrTrrrr4rrzPresolve_provider_client: custom/main requested but no endpoint credentials found)_get_named_custom_providerkey_env api_key_envuresolve_provider_client: named custom provider %r has no resolvable api_key — request will be sent with placeholder no-key-required and will 401 on auth-required endpointsr!rrzCresolve_provider_client: named custom provider %r (%s, api_mode=%s)rruNamed custom provider %r declares api_mode=anthropic_messages but the anthropic SDK is not installed — falling back to OpenAI-wire.FrrzAresolve_provider_client: named custom provider %r has no base_urlrrzsresolve_provider_client: azure-foundry requested but runtime resolution failed (run: hermes doctor for diagnostics))r.r/-resolve_external_process_provider_credentialsz-hermes_cli.auth not available for provider %sz,resolve_provider_client: unknown provider %rrVzOresolve_provider_client: anthropic requested but no Anthropic credentials foundrWz gh auth tokenzJresolve_provider_client: provider %s has no API key configured (tried: %s)rrIr2z resolve_provider_client: %s (%s))!_should_use_copilot_responses_apiudresolve_provider_client: copilot model %s needs Responses API — wrapping with CodexAuxiliaryClientexternal_processrXcommandrzVresolve_provider_client: copilot-acp requested but no model was provided or configuredz^resolve_provider_client: copilot-acp requested but external process credentials are incompleter)rrrrzLresolve_provider_client: external-process provider %s not directly supportedaws_sdk)has_aws_credentialsresolve_bedrock_region)build_anthropic_bedrock_clientzSresolve_provider_client: bedrock requested but boto3 or anthropic SDK not installedzGresolve_provider_client: bedrock requested but no AWS credentials foundz(anthropic.claude-haiku-4-5-20251001-v1:0z9resolve_provider_client: cannot create Bedrock client: %szaws-sdkzhttps://bedrock-runtime.z.amazonaws.comz)resolve_provider_client: bedrock (%s, %s)>oauth_externaloauth_device_codezMresolve_provider_client: OAuth provider %s not directly supported, try 'auto'z6resolve_provider_client: unhandled auth_type %s for %s)r:r:r)OrrjrkrtrrgrrrrrrrNrbrPrrvaluesr\r,rrrrrrrrrprGr0rrrrrrrrrrrErrr"ryrrrrrrrrr r.r/rr8r:raapi_key_env_varsr]rmrrrrr3updater;rrragent.bedrock_adapterrrrr)Kr`rvrZrrrFrrroriginal_providerrrrrr@ _is_visionr raw_clientr|r}r>rrr _gpf_custom _ph_custom_merged_customr_cbase _raw_ckey_ckeyr custom_entrycustom_key_enventry_api_moderzraw_base_for_wrap _clean_base2_dq2_extra2 _headers2rr_fallback_base _fb_clean_fb_dq _fb_extra _fb_headerssync_anthropic default_modelr.r/rr<rr tried_sourcesr=rrr3r _gpf_main_ph_main _merged_mainrrrrrrrregionrrsK ` ` @rrr sR "R..006688&x00H6 U+H55T9I9K9KTuCCD,OQ+-  S  %(       86(lCCC >:  SE\\h\3h3F3F LL89> J J JE'x NX+  JJJJk* ,<);KLLL > NNF022   :/0@(KK NX+  JJJJk* ,6 ,3355 5 ? ""$$**,,> $:666 > NNO P P P:/0@(KK NX+  JJJJk* ,>!!  NNG    :  -344K " TUUU!z3E8DDK#, 9+ F FJ  , ,-e44 > NNP Q Q Q:/0@(KK NX+  JJJJk* ,;5e<< > NNc   :/0@(KK NX+  JJJJk* ,8 . 0-.?@@FFHHK!'R..00%9-r2288::%$   ","z3_|M,**7333_R_KE8EE K -),o&$[.AA ,8:M+N'((&{4KLL KKKKKK+B+B"&),,,'(('{4NOO +CK+P+P'((MMMMMM!,X!6!6J!Tj&@T37 8R3S3S/0 D8CT9U9UVVN :+9'(NJNNNNF$_V[+zRRFR\/$V[INNNN +. 0,-FG 4 4F$fhhOFG!78H(SS WVZ<<BCC$FIr:: ' 22p:iQT;U;Up\_`i`omo\p\p(feLLV`3( RRRR$k2444" ; < < <zk JJJJJJ  I!2h!>!>556GHHL  55h??L [ &**:r::@@BBK%)))R88>>@@J*..y99b\=M=Mm=\=\b`biikkN C. CY~r::@@BB #8'8J...>!$$V,,8 'L,*:*::*F*FL"SSUUNF 47%#''00%5AK ((111t%())%%  "%999"-K(3%%"5k"B"BK(3%%>{%K%K" d59A?D11r7 DU8V8VWW ;1:G-. Yk>+O=OQQQ "%999<RRRRRR&<&#[*kTY&&&N"Z<^LLkYY);66U \UUWUU "%666z0@@62&+FFFF,_V[BSU_``FV`3( RRRR$k24 NNS   :w[ x      &?"" 2-/ ! ! !  > NN    :/0FQQ NX+  JJJJk* ,            DhOOOzz ##H--GExPPPzI%% { " "$2DT$U$U$U !FM~pqqq!z3E4J]HUUKR\w$V[INNNNcikvbw x44X>>eii 2..//5577  :&,,..9'G  !9::M9$$$$_555 LL6!499]#;#; = = =:599Z4455;;==DDSIIgWMg &|44  R*+<+B+B+D+D+K+KC+P+PQQH3H== /0FQQ x   a a a a a a a a((22 4++GhOOO ?;WWWV`3( RRRR$k24 > : : $7GL ! ! "8-D E E  G G G G G G NN22"i    #8-G H H  NN3H== > > > >  GGGGGG$9X..= 8=NN8#;<<<    27;;  #"GM(MM;BJ-w77MM y [   OOOOOO44[AAGLLO#%%%2&+FFF    !lGLL 7;OOONX+  JJJJk* ,...==hGG/  "-9C   )))t "!!    } $ $%))Ir223399;;G599Z4455;;==H%))Ir223399;;CtG &))/R00D "1"z "( "9"z A A A A A A%%! F LL;X{ S S SR\/$V[INNNN +. 0,-5 7 7 7z  i ' '  Y Y Y Y Y Y Y Y N N N N N N N    NNB C C C::  #"$$  LL4 5 5 5:''))B /0FQQ  88@@KK    NN(), . . .::::: * iFFFF     @+vVVVNX+  JJJJk* ,  E E E v  *65*EE E ~ % %*>5*MM M { " "*;zJJ J89A C C Cz NNK$h000 :s1S SSHf1afBc%"f$c%%)ffA f4f ff h%h;:h;+4u u-,u-#>s  7 AAc t|Sr)rtr`s r_normalize_vision_providerrs "8 , ,,rc,t|}|dkrtd|dS|dkrt|S|dkrtdS|dkrtd|dS|d krt S|d krt Sd S) NrWTrrrvrrVrhrVrfr0)rrrNr\r:rrs r_resolve_strict_vision_backendr s*(33H9&y%4HHHH<U++++6%%%%>!!'~uMMMM;8#%%% :rc0t|dduSr)r rs r _strict_vision_backend_availabler s )( 3 3A 6d BBrc^g}t}|rh|dvrd|tvr%t|r||n6t |t \}}|||tD]*}||vr$t|r||+|S)uReturn the currently available vision backends in auto-selection order. Order: active provider → OpenRouter → Nous → stop. This is the single source of truth for setup, tool gating, and runtime auto-routing of vision tasks. >r:rb)rn_VISION_AUTO_PROVIDER_ORDERr r]rrg) availablerrrtrs rget_available_vision_backendsrsI'))M0l:: 7 7 7/ >> 0  //// ?O?Q?QRRIFA!  /// (   I  "B1"E"E    Q    r)rrrZc Btd||||\}}}}t|}dtdtdttffd } |r.|r|dvr|nd} t | |||\} } | | d d fS| | | fS|d krlt } t}| r| dvrt | |}| d krCt| |\}}|-t d | |pp|| | ||Sn| tvrtd | nqt| |std| nEt | ||d\}}|-t d | |p|| | ||p|St D],}|| kr t|\}}|| |||cS-tddS|t vr t|\}}| |||S|dkrZ|sXddg}|D].}t#|||pd dd\} } | | || | cS/t#||d\} } | |d d fS|| | fSt#||d\} } | |d d fS|| | fS)arResolve the client actually used for vision tasks. Direct endpoint overrides take precedence over provider selection. Explicit provider overrides still use the generic provider router for non-standard backends, so users can intentionally force experimental providers. Auto mode stays conservative and only tries vision backends known to work today. rQr=rrc\||ddfSp|}rt||d\}}|||fS|||fS)NTr)r)r=rrr async_client async_modelrZrRs r _finalizez1resolve_vision_provider_client.._finalize3s]  $dD0 0$5  @(8k]a(b(b(b %L+$lK? ? +{::r>r:rbrf)rvrZrrFrNrbrz/Vision auto-detect: using main provider %s (%s)uiVision auto-detect: skipping main provider %s (no vision support) — falling through to aggregator chainutVision auto-detect: skipping main provider %s (reports no vision capability) — falling through to aggregator chainT)rrz'Auxiliary vision client: none availablervrMz$https://open.bigmodel.cn/api/paas/v4zhttps://api.z.ai/api/paas/v4r)rrrr)rrrrrrrnrgrrpr rrrrrrrb)r`rvrrrZrsrSrTrUrprovider_for_base_overriderrrr vision_modelrr rpc_client rpc_modelrzai_openai_urls_zai_urlrRs ` @rraras\Yu(E8WYYUI~02BDU+955I;S;s;8TW=;;;;;;;?" Ry 'D'DII( #6 & !/-&      >-tT9 9)6;>>F,-- %'' 5 N],>>266}jQQL&&-K!<..* ]*KKI%}'T'T*%9]KOOO + ";;; N! 1 MM N '" )@!<.")$)$)$% I)KKI%y'@L%9%z93L NNN 5 H HIM)))G )R)R &K& yKGGGGG'  >???///%C ~& & " ]yK??? E"3 2 * ( A AH"4>:!(0D+ ### FK! yFK@@@@@"1NJ:K;?AAA  >dD( (&+--,Y 6G7;===FK~$$$ fk ))rc0trtniS)zReturn extra_body kwargs for auxiliary API calls. Includes Nous Portal product tags when the auxiliary client is backed by Nous Portal. Returns empty dict otherwise. )rrrrrget_auxiliary_extra_bodyrs "3 :    :rr rct}tjd}|s#tt |dvrd|iSt |rd|iSd|iS)uReturn the correct max tokens kwarg for the auxiliary client's provider. OpenRouter and local models use 'max_tokens'. Direct OpenAI with newer models (gpt-4o, gpt-4.1, gpt-5+, o-series) requires 'max_completion_tokens'. The Codex adapter translates max_tokens internally, so we use max_tokens for it as well. Pass ``model`` so third-party OpenAI-compatible endpoints fronting the newer families are also recognised — URL-only detection misses the case where a custom base URL serves e.g. ``gpt-5.4``. rJN>rr6rr)rrrrr1r2)rrvr|rMs rauxiliary_max_tokens_paramrsz+,,K Y+ , ,F 0!!)!+..2]]]'//)%000'// %  rr-@)rrrrrc t| |dkr t fdtDnd}t||}|||pd|pd|pd|||fS)Nrbc3DK|]}|dVdS)r:Nrz)r>rrZs rrz$_client_cache_key.. s1QQ5 E2..QQQQQQrrr7r:)rtuplerr:) r`rZrrrrr runtime_key pool_hintrZs @r_client_cache_keyr&s~&l33GU]agUgUg%QQQQz(neuter_async_httpx_del..dstrN)openai._base_clientr8__del__rAttributeErrorr7s rneuter_async_httpx_delr>HsR4 ??????*;*;'''  (     s ''c ddlm}t|dd}|t|dds|j|_dSdSdS#t $rYdSwxYw)uMark the httpx AsyncClient inside an AsyncOpenAI client as closed. This prevents ``AsyncHttpxClientWrapper.__del__`` from scheduling ``aclose()`` on a (potentially closed) event loop, which causes ``RuntimeError: Event loop is closed`` → prompt_toolkit's "Press ENTER to continue..." handler. We intentionally do NOT run the full async close path — the connections will be dropped by the OS when the process exits. r) ClientStaterN is_closedT) httpx._clientr@rCLOSED_stater)rr@inners rr.r.is ------ 400  WUK%F%F &-ELLL          s6> A  A cddl}t5ttD]b\}}|d}|t | t |dd}|r||s |S#t$rY_wxYwt ddddS#1swxYwYdS)zClose all cached clients (sync and async) to prevent event-loop errors. Call this during CLI shutdown, *before* the event loop is closed, to avoid ``AsyncHttpxClientWrapper.__del__`` raising on a dead loop. rNr)) inspectr,rar-rCr.riscoroutinefunctionrr)rGrrrr~s rshutdown_cached_clientsrI}s0 NNN }224455  JC1XF~ %V , , , "67D99G$?$?$I$IHJJJ    !s6AB<2BB< BB<BB<<CCc$t5g}tD]E\}}|\}}}|8|r$t |||F|D] }t|= ddddS#1swxYwYdS)uKForce-close cached async clients whose event loop is closed. Call this after each agent turn to proactively clean up stale clients before GC can trigger ``AsyncHttpxClientWrapper.__del__`` on them. This is defense-in-depth — the primary fix is ``neuter_async_httpx_del`` which disables ``__del__`` entirely. N)r,r-rCrAr.r])r/rrr_default cached_loops rcleanup_stale_async_clientsrMs ## '--// ' 'JC,1 )FHk&;+@+@+B+B&(000!!#&&& # #Cc"" ###################sA/BB  B c |t|ddt|ddfD]5}|r1ttt|ddpddrdS6dS)Nrrrr:rwTF)rr0r)rr#s r_is_openrouter_clientrOsr 488'&(TX:Y:YZ  (WS*b-I-I-OR)P)PRabb 44 5rcached_defaultcJt|rdSt|od|vS)zFBest-effort check for cached clients that accept ``vendor/model`` IDs.Trx)rOr)rrPs r#_cached_client_accepts_slash_modelsrRs/V$$t 83.#8 9 99rc:|rd|vrt||s|S|p|S)zKeep slash-bearing model IDs only for cached clients that support them. Mirrors the guard in resolve_provider_client() which is skipped on cache hits. rx)rR)rrvrPs r _compat_modelrTs5  &I&R`&a&a  "N"rc jd}|r* ddl} | }n#t$rYnwxYwt|} t |||||||} t 5| t vrt | \} } }|rX|duo||uo| }|r!t| || }| |fcdddSt| t | =n!t| || }| |fcdddSdddn #1swxYwY|}|s1tt|}|t|}|r|}t||||||| |\}}||}t 5| t vrtt tkrpt!t#t \}}t|dt |=tt tkp|||ft | <nt | \}}}dddn #1swxYwY||p|fS)aGet or create a cached client for the given provider. Async clients (AsyncOpenAI) use httpx.AsyncClient internally, which binds to the event loop that was current when the client was created. Using such a client on a *different* loop causes deadlocks or RuntimeError. To prevent cross-loop issues, the cache validates on every async hit that the cached loop is the *current, open* loop. If the loop changed (e.g. a new gateway worker-thread loop), the stale entry is replaced in-place rather than creating an additional entry. This keeps cache size bounded to one entry per unique provider config, preventing the fd-exhaustion that previously occurred in long-running gateways where recycled worker threads created unbounded entries (#10200). Nrr/)rrFrrr)rr0rkrr&r,r-rArTr.rrtrrr_CLIENT_CACHE_MAX_SIZEnextiterrC)r`rvrZrrrrrr3r4rZr) cached_clientrPrLloop_ok effectiveeffective_api_key_pe_pkrrr( evict_key evict_entryrts rrbrbs<L  " " " "..00LL    D %l33G!!I 00  % %9Fy9Q 6M>; 0  t+4#|34'11333 4 -mUN S SI()300000000 )777!),,)-OO $i/)000000000000000000000006  (6x@@AA ?',,C ($'!3 "*   FM"  D D ---((,BBB-1$}7J7J7L7L2M2M-N-N*I{,[^<<<%i0-((,BBB-3M:+N i((+8+C( q D D D D D D D D D D D D D D D 5)M ))s8 ,,AC=8,C==DD"B6H$$H(+H(rzhttps://api.openai.com/v1_AUX_DIRECT_API_BASE_URLSc d}d}d}d}d} |r"t|} t| ddpd}t| ddpd}t| ddpd}t| ddpd}t| ddpd} |p|} | } dttd ttd t ttttffd } |r| ||\}}|r| ||\}}|rd | ||| fS|r|| ||| fS|r2|r |rd | ||| fS|r|r |d kr|| |d| fS|r |d kr|| ||| fSd | dd| fSd | dd| fS)aDetermine provider + model for a call. Priority: 1. Explicit provider/model/base_url/api_key args (always win) 2. Config file (auxiliary.{task}.provider/model/base_url) 3. "auto" (full auto-detection chain) Returns (provider, model, base_url, api_key, api_mode) where model may be None (use provider default). When base_url is set, provider is forced to "custom" and the task uses that direct endpoint. api_mode is one of "chat_completions", "codex_responses", or None (auto-detect). Nr`r:rvrrrr existing_baserc|s||fSt|}|||fSd|p|fS)Nrf)rarprjrk)rrc target_bases r_expand_direct_api_aliasz>_resolve_task_provider_model.._expand_direct_api_aliasks] '& &/33DJJLL4F4F4H4HII  & &5+55rrfrb)rrrprjrr )rr`rvrrr cfg_modelr cfg_api_key cfg_api_moderrRrUrfs rrrAs&LILKL L066 ;??:r::;;AACCKt  4455;;==E ;??:r::;;AACCKt +//)R8899??AAIT ;??:r::;;AACCKt 'iN$6x}6Xc]6W\]efi]jltuxly]yWz6666J55hII(Z%=%=lL%Y%Y" lN74/@ @@r>@c`|siS ddlm}|}n#t$ricYSwxYwt|tr|dini}t|tr||ini}t|tsi} ddlm}|D]q}|d|krV|dpi}t|tr(t |}|||cSnrn#t$rYnwxYw|S)uReturn the config dict for auxiliary., or {} when unavailable. For plugin-registered auxiliary tasks (see :meth:`hermes_cli.plugins.PluginContext.register_auxiliary_task`) the plugin's declared *defaults* are layered underneath the user's config so an unconfigured plugin task still works: plugin defaults ← config.yaml auxiliary. (user wins) Built-in tasks ignore this path (their defaults live in DEFAULT_CONFIG). rr auxiliary)get_plugin_auxiliary_tasksrdefaults) rrrr"rrphermes_cli.pluginsrmrr) rrconfigauxrrm_entry _defaultsrs rrrs  111111  )3FD)A)A I&**[" % % %rC'1#t'<'<D#''$###"K k4 ( (  AAAAAA0022  Fzz%  D(("JJz228b i.."!)__FMM+...!MMM )       s% &&A>DD D+*D+r@c|s|St|}|d}|' t|S#ttf$rYnwxYw|S)zPRead timeout from auxiliary.{task}.timeout in config, falling back to *default*.r)rrprrr6)rr@rraws r_get_task_timeoutrvsm ,T22K //) $ $C  :: I&    D  Ns;AAct|}|d}t|trt|SiS)zFRead auxiliary..extra_body and return a shallow copy when valid.r)rrpr"r)rrrus r_get_task_extra_bodyrxsC,T22K //, ' 'C#tCyy Ir> minimax-oauthminimaxrUcL|tvrdS|pd}d|vS)zDetect if an endpoint expects Anthropic-format content blocks. Returns True for known Anthropic-compatible providers (MiniMax) and any endpoint whose URL contains ``/anthropic`` in the path. Tr:r)_ANTHROPIC_COMPAT_PROVIDERSrk)r`r url_lowers rrdrds5 ...tR&&((I 9 $$rc g}|D]]}|d}t|ts||Cg}d}|D]}|ddkr|dpidd}|drv|d\}} } d } d |vr:d |vr6|d d d d d d } |dd| | ddn|dd|ddd}|ddkr|dpidd} | drv| d\}} } d} d |vr:d |vr6|d d d d d d } |dd| | ddn|dd| ddd}||||ri|d|in|_|S)asConvert OpenAI ``image_url``/``video_url`` blocks to Anthropic format. Converts: - ``image_url`` blocks to Anthropic ``image`` blocks - ``video_url`` blocks to Anthropic ``video`` blocks (MiniMax M3 compat) Only touches messages that have list-type content with ``image_url`` or ``video_url`` blocks; plain text messages pass through unchanged. rFr$ image_urlr8r:zdata:,z image/pngrd;rerimager)r$ media_typer)r$r)r$r8T video_urlz video/mp4video)rpr"rar]rl partitionrm) r ruror new_contentchangedblock image_url_valheaderrtb64datar video_url_vals rreresIENEN'')$$'4((    S ! ! !  = *= *Eyy  K//!&;!7!7!=2 B B5" M M  ++G44)6)@)@)E)E&FAw!,Jf}}%+\\#q%9%9!%<%B%B3%J%J1%M && '$,*4$+##(( && '$)#0##((6""k11"';!7!7!=2 B B5" M M  ++G44)6)@)@)E)E&FAw!,Jf}}%+\\#q%9%9!%<%B%B3%J%J1%M && '$,*4$+##(( && '$)#0##((""5))))GL8C8K888MMMM rrrc |||d} t||} | turd}n| | }|ddlm} | |rd}||| d<|-|p|dkrt nd} t || r|| d<|rt } g}|D]}}|d pid d}|r"|| vrt d |||Q|r| || |~|| d <t|pi}|d kstr5|dgt!|r|| d<| S)zLBuild kwargs for .chat.completions.create() with model/provider adjustments.)rvr rNrrrrfr:rr r!zK_build_call_kwargs: duplicate tool name '%s' removed (provider=%s model=%s)rrrr)rrurrrrdr,rprrbrr]rr setdefaultextendr)r`rvr rrrrrrrfixed_temperaturer_effective_base_seen_deduped_t_tname merged_extras rrcrc?sF 5UHEE,,,  &' DDDDDD # #E * * K +}# *2h*>*> $ & & &B  )? C C .#-F<  # UU BffZ((.B33FB??F &E//-He  " &!!! OOB    "w (b))L6.++223D3F3FGGG,+| Mrrc `|td|pdd |j}|rt|ddstdnf#ttt f$rL}t |j}t|dd}td|pdd |d |d |d}~wwxYw|S) a3Validate that an LLM response has the expected .choices[0].message shape. Fails fast with a clear error instead of letting malformed payloads propagate to downstream consumers where they crash with misleading AttributeError (e.g. "'str' object has no attribute 'choices'"). See #7264. Nr\rz: LLM returned None responserrEzmissing choices[0].messagexz&: LLM returned invalid response (type=z): ug. Expected object with .choices[0].message — check provider adapter or custom endpoint compatibility.) rkrZrr=r6 IndexErrorr$r(r)rrrZr response_typeresponse_previews rrfrfs E E E E   " ?ggaj)<< ? !=>> > ? Iz 2X/ x==#. 9 9 9" 9 9'7 9 9 9     Os.AB+AB&&B+) r`rvrrrrrrrrc vt|||||\} } }}}t|}|| pi|dkr~t| dkr| n|| p||p||p|d\}}}|9| dkr3|s1td| td| d\}}}|t d|d | d |p| } nt| | |||| \}}|| pd  }|r,|d vr(t d|d| d|s2t d|pd| td|\}}|t d|d | d | | nt|}tt|d|pd }|r-t d|| pd|pd|r d|vrd|nd t| ||||| |||p| }tt|dd pd }t!| |rt#|d|d< t%|jjjd;i||S#t,$r]}t/|st d|pd|t%|jjjd;i||cYd}~Sd}~wwxYw#t,$rX}d|vrt1|rt3|}|ddt d|pd t%|jjjd;i||cYd}~S#t,$rS}t|}t7|s't9|st;|s d|vsd|vs|}|}Yd}~nd}~wwxYwt|}d |vod!tt|dd v} |d|vsd|vst=|ds| r|dd|d"d t%|jjjd;i||cYd}~S#t,$r:}t7|st9|st?|s|}Yd}~nd}~wwxYw| d#kptA|d$}!tC|r|!rtE|dk|#d%&}"|"r|"|#d%kr{td'|pd|#d%|"|"|d%< t%|jjjd;i||cYd}~S#t,$r }|}Yd}~nd}~wwxYw| d#kptA|d$}#t7|r|#rtIrtK| pd#|d|||||dk(\}$}%|$t d)|pd|%r|%|#d%kr|%|d%< t%|$jjjd;i||cYd}~S#t,$rI}t;|s.t7|st9|st?|s|}Yd}~nd}~wwxYwt;|r|#rtK| pd#|d|||||dk(\}$}%|$gt d*|pd|%r|%|#d%kr|%|d%<t%|$jjjd;i||cYd}~St;|rU| d+vrQ|#sOtM| r@t d,|pd| tO|| | ||||||||| ||-cYd}~StQ| ||}&tt|d.d pd }'|&r~t;|st7|st?|rP|}(t?|rt7|sr t%|jjjd;i||cYd}~S#t,$r:}t;|st7|st?|s|}(Yd}~nd}~wwxYwtS|&|(|'/rt d0|pd|&tU|(j+ tO|| | ||||||||| ||-cYd}~S#t,$rK})t7|)st;|)st?|)rtS|&|)|)}nYd})~)nd})~)wwxYwt7|pt9|pt?|}*| d+v}+t7|pt9|},|*r<|+s|,r7t7|r$d1}-tYtQ| ||p| nt?|rd2}-nd3}-t d4|pd|-| |d5\}.}/}0|+rt[| ||-6\}.}/}0n0t]|| pd|-6\}.}/}0|.t_| ||-6\}.}/}0|.`t|0|/|||| ||tt|.dd pd  }1t%|.jjjd;i|1|cYd}~Std7|pd|-| t9|r= ta|n,#t,$rt1d8d9:YnwxYwd}~wwxYw)rbrfr Provider ':' is set in config.yaml but no API key was found. Set the U_API_KEY environment variable, or switch to a different provider with `hermes model`.BAuxiliary %s: provider %s unavailable, trying auto-detection chainrr7rzAuxiliary %s: using %s (%s)%sr@rz at r_r z_Auxiliary %s: transient transport error; retrying once on the same provider before fallback: %srzEAuxiliary %s: provider rejected temperature; retrying once without itrr1210rrrr?rvrQr]z[Auxiliary %s: model %r no longer in Nous catalog; retrying with refreshed recommendation %r)r-rvrZrrrrrzSAuxiliary %s: refreshed Nous runtime credentials after paid account check, retryingzDAuxiliary %s: refreshed Nous runtime credentials after 401, retrying>Nr:rbzAAuxiliary %s: refreshed %s credentials after auth error, retrying)rr=rRrSrTrUrrr rrrrVrWrrEz@Auxiliary %s: recovered %s via credential-pool rotation after %srurconnection errorz,Auxiliary %s: %s on %s (%s), trying fallbackrrwzoAuxiliary %s: %s on %s and all fallbacks exhausted (fallback_chain + main agent model). Raising original error.z7Auxiliary: cache eviction after connection error failedTr*r)2rrxrrarrbrkrbrjrkupperrrvrrrcrdrerfrrrjrrr"rrrrrr rr0r(rarprr5rtrkrDrQr$r(rKrrrr-r)2rr`rvrrrr rrrrrr=rRrSrTrUrWeffective_providerrr _explicitrV _base_infor _client_base transient_err first_errrj retry_err retry_err_strerr_str_is_zai_param_error _heal_is_nous healed_modelclient_is_nousrefreshed_clientrefreshed_model pool_provider_client_api_key recovery_err retry2_errshould_fallbackis_autois_capacity_errorrwrrfb_label fb_kwargss2 rcall_llmrs%Na} hxa2a2]~'8:JL]/55 0b111 x2P*;v*E*E&&8 )E&2($/ 3 3 3 /FK >/699BS9 NNV!   7U$ 777 3  >%t%%GX%%% /C2C0  &$&%      >+0b7799??AAI Y.NNN"XXX*3//*;*;XXX% \ ` NF,=???&8l&[&[&[# >%t%%GX%%%&& &$+#6??  WNF$51&7#1&7%5&7!- +% +)&7)=$33Df[ghhh gfi<<BCC - nY77- ;LY;W;W- [opy[z[z- $L$I.. -7H7S7S --16 /6@@@@$HHHHHHHH ---*9559J99U9UYmnwYxYx#,LLLLLL-&m\Rabbb!  VNFM4 3E3E3N4!*;'5*;)9*;%1$/!)$/#-#*;-A !    **55 9S9S3J??.}jIII$. "  > i ( ( /#I.. /#I.. $'99.i88[l3<$Q& l8& R*00R% l3%R**B$l3$U93l89 VV l3 VBl3'$Y l8 Z$?Zl3Z$$Bl3;l8Al3l8%Bl3)$a l8 b0b l3bAl3d:l8 e Ae l3eE,l3l8.l36ll3&l/,l3.l//l33l8cddl}|jdj}|jpd}|r<|dd||j|jz}|r|Sg}dD]i}t||d}|rTt|tr?|r+||vr'| |jt|dd}|rt|tr|D]} t| tr| dp)| d p| d } | rO| |vrK| t| tr| nt| |rd |SdS) uExtract content from an LLM response, falling back to reasoning fields. Mirrors the main agent loop's behavior when a reasoning model (DeepSeek-R1, Qwen-QwQ, etc.) returns ``content=None`` with reasoning in structured fields. Resolution order: 1. ``message.content`` — strip inline think/reasoning blocks, check for remaining non-whitespace text. 2. ``message.reasoning`` / ``message.reasoning_content`` — direct structured reasoning fields (DeepSeek, Moonshot, NovitaAI, etc.). 3. ``message.reasoning_details`` — OpenRouter unified array format. Returns the best available text, or ``""`` if nothing found. rNr:zz<(?:think|thinking|reasoning|thought|REASONING_SCRATCHPAD)>.*?)flags)rreasoning_contentreasoning_detailsrrrFz )rerZrErrjsubDOTALL IGNORECASErr"rr]rarrprm) rrrorcleanedreasoning_partsrrBdetailsdetailrs rextract_content_or_reasoningrsIII  1  %C{ b''))G && L ry2=8   %''   N"$O300c5$''  0:c3'' 0CIIKK 0CV>V+h7==???\_`g\h\hiii,{{?+++ 2rc Kt|||||\} } }}}t|}|| pi|dkr~t| dkr| n|| p||p||p|d\}}}|9| dkr3|s1td| td| d\}}}|t d|d | d |p| } nt| | d||| \}}|| pd  }|r,|d vr(t d|d| d|s2t d|pd| tdd\}}|t d|d | d | | nt|}tt|dd pd }t| ||||| |||p| }t!| |rt#|d|d< t%|jjjd8i|d{V|S#t,$rc}t/|st d|pd|t%|jjjd8i|d{V|cYd}~Sd}~wwxYw#t,$r}d|vrt1|rt3|}|ddt d|pd t%|jjjd8i|d{V|cYd}~S#t,$rS}t|}t7|s't9|st;|s d|vsd|vs|}|}Yd}~nd}~wwxYwt|}d|vodtt|dd v}|d|vsd|vst=|ds|r|dd|dd t%|jjjd8i|d{V|cYd}~S#t,$r:}t7|st9|st?|s|}Yd}~nd}~wwxYw| dkptA|d } tC|r| rtE|dk|#d!"}!|!r|!|#d!krtd#|pd|#d!|!|!|d!< t%|jjjd8i|d{V|cYd}~S#t,$r }|}Yd}~nd}~wwxYw| dkptA|d }"t7|r|"rtIrtK| pd|d||||dk$\}#}$|#t d%|pd|$r|$|#d!kr|$|d!< t%|#jjjd8i|d{V|cYd}~S#t,$rI}t;|s.t7|st9|st?|s|}Yd}~nd}~wwxYwt;|r|"rtK| pd|d||||dk$\}#}$|#mt d&|pd|$r|$|#d!kr|$|d!<t%|#jjjd8i|d{V|cYd}~St;|rZ| d'vrV|"sTtM| rEt d(|pd| tO|| | |||||||| ||) d{VcYd}~StQ| ||*}%tt|d+d pd }&|%rt;|st7|st?|r[|}'t?|rt7|sx t%|jjjd8i|d{V|cYd}~S#t,$r:}t;|st7|st?|s|}'Yd}~nd}~wwxYwtS|%|'|&,rt d-|pd|%tU|'j+ tO|| | |||||||| ||) d{VcYd}~S#t,$rK}(t7|(st;|(st?|(rtS|%|(|(}nYd}(~(nd}(~(wwxYwt7|pt9|pt?|})| d'v}*t7|pt9|}+|)r{|*s|+rvt7|r"d.},tYtQ| |p| nt?|rd/},nd0},t d1|pd|,| |d2\}-}.}/|*rt[| ||,3\}-}.}/n0t]|| pd|,3\}-}.}/|-t_| ||,3\}-}.}/|-t|/|.|||| ||tt|-dd pd  }0ta|-|.pd |dk4\}1}2|2r|2|0#d!kr|2|0d!<t%|1jjjd8i|0d{V|cYd}~Std5|pd|,| t9|r= tc|n,#t,$rt2d6d7YnwxYwd}~wwxYw)9zqCentralized asynchronous LLM call. Same as call_llm() but async. See call_llm() for full documentation. rQrbTrYNrrrrrrmr:>rbrfrrrrrr)rZrr_r zgAuxiliary %s (async): transient transport error; retrying once on the same provider before fallback: %srzMAuxiliary %s (async): provider rejected temperature; retrying once without itrrrrrrr?rvrzcAuxiliary %s (async): model %r no longer in Nous catalog; retrying with refreshed recommendation %r)r-rvrZrrrrz[Auxiliary %s (async): refreshed Nous runtime credentials after paid account check, retryingzLAuxiliary %s (async): refreshed Nous runtime credentials after 401, retrying>Nr:rbzIAuxiliary %s (async): refreshed %s credentials after auth error, retrying) rr=rRrSrTrUrr rrrrVrWr7rrEzHAuxiliary %s (async): recovered %s via credential-pool rotation after %srurrz4Auxiliary %s (async): %s on %s (%s), trying fallbackrrrzwAuxiliary %s (async): %s on %s and all fallbacks exhausted (fallback_chain + main agent model). Raising original error.z?Auxiliary (async): cache eviction after connection error failedr*r)3rrxrrarrbrkrbrjrkrrrvrrrcrdrerfrrrjrrr"rrrrrr rr0r(rarprr5rtrnrDrQr$r(rKrrrrr-r)3rr`rvrrrr rrrrrr=rRrSrTrUrWrrrrrVrrrrrjrrrrrrrrrrrrrrrrrwrrrrasync_fbasync_fb_models3 rasync_call_llmrs&a} hxa2a2]~'8:JL]/55 0b111 x2P*;v*E*E&&8 )E&2($/ 3 3 3 /FK >/699BS9 NNV!   7U$777 3  >%t%%GX%%% /C2C0  &$&      >*0b7799??AAI Y.NNN"XXX*3//*;*;XXX % R ` NF,=???&8D&Q&Q&Q# >%t%%GX%%%&& &$+#6>v>>>>>>>>FF F F F F0??  KK@     *4fk-4>>v>>>>>>>>FF F F F F F F F PPP F " "'H'S'S "<??  _NF$58&7#1&7%5&7 +% +)&7)="33Df[ghhh gfi<<BCC ' nY77' ;LY;W;W' [opy[z[z' $L$I.. -7H7S7S --1m*P1+m"1 Q5;0Q0+m0Q55B$m*U m" U UmU  Bm7*X'!m"' Y:1?Y50m5Y::Bmm"A#m?m"Bm *`93m"9 a=0a83m8a==Am!c+%m"+ e5Ad;6m;eF+m+m"1.m l0/m0&mmmmm"r)r:r0rr[)Nru)Nr)rrv)NFFNNNNF)NFNNNNF)NNNNN)NNNrjNN)r+rloggingrrcr2pathlibrtypesrtypingrrrrr r rr r r rrrr$__annotations__rragent.credential_poolr-rr.hermes_constantsr/utilsr0r1r2r3 getLoggerr(rrr7rrGrrortobjectrur~rrrrrrrrrr frozensetrrrrrrrragent.portal_tagsrrrNOUS_EXTRA_BODYrrLrXrrrrrrrrrrrrrrrrrrrrrrrrrrrr#rr&r,rErNrPr\rargrnrircrjrkrlrnrprrrrrrrrr:_AUTO_PROVIDER_LABELSrrrrrrrrrKr9rrrrrrrrrr r"r(r0r-r:r<rDrQrarrkrnrtrrrrrrrrrrrrrr r rrarrr-Lockr,rVr&r,r5r>r.rIrMrOrRrTrbrar_DEFAULT_AUX_TIMEOUTrrvrxr|rdrercrfrrrrrrrs~"(((T   !!!!!!BBBBBBBBBBBBBBBB7777777777$(8D>((($,,,,,,,,& ++++++------000000xxxxxxxxxxxx  8 $ $#343 hX E   E   E  5 E E U M # !"\#$'&!"'%=D9hsm999992"688&###6(3-6D6666 ,hsm,,,,,%)![[8C=[HSM[T[[[[&# C=sm 0#)-  C=sm"&  e_ : FS FS F F F F(' *- 1,$/)% 9 9%tCH~   "0Ud38nTTT ++c3h(1y2((9<7Y999:::11t 1t1111n} sTzd DCCCCC)$))))#"$$ 44- D9!/##k1>$C$DcN$$$$N##<  tXc]/B)C     sx}."""""" . .# . .c . . . .(\ \ \ \ \ \ \ \ ~########""""""""$ D D D D D D D D######## 66666666&X X X X X X X X v########         DDDDDDDD######## 6 6 6 6 6 6 6 6#$B# OOO OO O sm O  OOOOd#$####LDS(HHHHH 8=%PSUXPX/AZ44HU38_$=4444n((3-((((Vo5&)98C=)H#IoooolSScSShW]N^`hil`mNmHnSSSS* 4# 4 4 4 4QQdQuXf-=x}-L'MQQQQh&&"*3-& c]&&&&R#<S6! S  s   6666 6 6  6  6 66668    /8x}hsmXc]'R!S/8/8/8/8d# :$0#eHSM8C=$@A0#0#0#0#f;s;uXc]HSM5Q/R;;;;4&;s&;uXc]HSM-I'J&;&;&;&;V &*'+" ooo C=osmo } o sm o  8C=(3- '( ooood-c-cS-cE(3-RU:V4W-c-c-c-cb$*!* ](4S>*BtCQTH~4T%[R!)+d3:&+++-/$sEz*///  ""     2S 2S 2 2 2 2s%D& # $       s  (3-  4     %%%%%9%%%%%P D    "i"D""""J#i#D####LNyNTNNNN& d$34D?9?????%9%%%%%P)C)D))))* # $    L.2&&&&4S>*& &&&&*Y4S>.2((( (4S>*(c] ((((VTV...S.y.S.Z^....b7 3-77SM 7  } 7 sm 7 }74S>*7#77%7 7 D>777  !7777t6 3-66SM 6  } 6 sm 6 }6#66%6 6 D>666 6666r7C7D7777x!000 0 0 8C=(3- ,- 0000j.7.7.7 .7 .7 8C=(3- ,- .7.7.7.7h88 88 8 8C=(3- ,- 8888z "!  C=smc]  c] &vvc3h 8vE(SYJZ\deh\iJiDjvvvvH>.>.>.>.>.>.>.B (3- 3 8TW=    ! -1I I I  I I  I   I   I I 4S>*I I  8C=(3- '(I I I I ^.2 4S>* 8F Xc] *+ 2`d#XdSVX[S[nE]& #hsm>-#-3----   C= 8C=(3- '(.CsCtCCCCtCy4#d*#! d*d*d*smd* C=d*sm d* c] d*  d* 8C=(3-# 67d*d*d*d*N;$;;;;FJ!!!c!Xc]!d!!!!T%' tE5L!&&&#Y^%%#!"-1 t t t t tsm t c] t sm t4S>* t t  t t t t lp G G GE G3 GxPS} Geh Gtx G G G G&#!"-1)))) C=) ) sm ) c] )sm)4S>*)) 8C=(3- '())))X    B S T    (6####&#$::Xc]:W[::::###hsm#Xc]#W_`cWd####-1j*j*j* j*j* j*  j*  j*4S>*j*j* 8C=(3- '(j*j*j*j*t )-4S>  KAKA KAKA KA KA  KA  3 x}hsmXc] JK KAKAKAKA\)S)T#s(^))))X3G  C % 5    stCH~(i(R(R(RSS %C %3 %4 % % % %Q$Q4QQQQr$( $ !%"UUU UU% U  U D> UUUsmU UUUUpSs@Q-1QQQ QQ  Q  Q  Q4S>*QQQQ QQQ QQQQh5c5555r{-1{{{ {{  {  {  {4S>*{{{{ {{{ {{{{{{r