j\FdZddlmZddlZddlZddlZddlmZddlm Z m Z m Z eje ZddlmZddlmZmZmZmZddlmZdd lmZmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*dd l+m,Z,m-Z-dd l.m/Z/dd l0m1Z1m2Z2m3Z3d/d0d Z4d1dZ5d2dZ6d3dZ7d4dZ8d5dZ9d5dZ:d6dZ;d7d8dZd:dZ? d;dZ@dddd d d?dZCd@dZDdAdZEdBd ZFd4d!ZGddd" dCd#ZHdDd$ZIdEd%ZJddd& dFd'ZKddd& dGd(ZLdddd) dHd*ZMddd& dId+ZNddddd, dJd-ZOdKd.ZPy)LzGShared runtime provider resolution for CLI, gateway, cron, and helpers.) annotationsN)urlparse)AnyDictOptional)auth)CredentialPoolPooledCredentialget_custom_provider_pool_key load_pool) get_secret) AuthErrorDEFAULT_CODEX_BASE_URLDEFAULT_QWEN_BASE_URLDEFAULT_XAI_OAUTH_BASE_URLPROVIDER_REGISTRY_agent_key_is_usableformat_auth_errorresolve_provider resolve_nous_runtime_credentials!resolve_codex_runtime_credentials%resolve_xai_oauth_runtime_credentials resolve_qwen_runtime_credentials(resolve_gemini_oauth_runtime_credentials$resolve_api_key_provider_credentials-resolve_external_process_provider_credentialshas_usable_secret)get_compatible_custom_providers load_config)OPENROUTER_BASE_URL)base_url_host_matchesbase_url_hostnameenv_intc&t||}||S|S)aProfile-scoped replacement for ``os.getenv`` on credential/provider reads. Routes through the secret scope (Workstream A): identical to ``os.getenv`` when multiplexing is off, scope-aware (and fail-closed on an unscoped read) when on. Genuinely-global vars are handled inside ``get_secret`` and still read ``os.environ``. Keeps the ``(name, default) -> str`` contract every call site here already relies on. ) _get_secret)namedefaultvals Z/home/cube/projects/richard/.worktrees/nutricoach-v140-impl/hermes_cli/runtime_provider.py_getenvr*'s dG $C/3.w.c^|jjjddS)N -)striplowerreplacevalues r)_normalize_custom_provider_namer44s$ ;;=   ( (c 22r+cP|xsdjjd}|dvS)N.>::10.0.0.0 localhost 127.0.0.1)r0rstrip)hosths r)_loopback_hostnamer?8s+ ##C(A < <!i:&=# r+ct|}|sytd|jddDry|dvsd|vry|jdDcgc]}|s| }}|r"|ddvr|jd|r|ddvrt |d kry|d }dj d |Dj }|r|djsy|d vry|d }t|dxsdjScc}w)u_Look up `_API_KEY` in the env, derived from the base URL host. Examples: https://api.deepseek.com/v1 → DEEPSEEK_API_KEY https://api.groq.com/openai/v1 → GROQ_API_KEY https://api.mistral.ai/v1 → MISTRAL_API_KEY https://generativelanguage.googleapis.com/v1beta/openai/ → GOOGLEAPIS_API_KEY Returns the env value (stripped) or "". Never returns env vars whose names are already explicitly checked elsewhere — those are handled by their own host-gated paths (OPENAI/OPENROUTER/OLLAMA). The vendor label is the *registrable* portion of the hostname: strip ``api.`` / ``www.`` prefixes, then take the second-to-last label (``api.deepseek.com`` → ``deepseek``). Falls back to "" for hostnames that don't yield a usable vendor label (IPs, loopback, single-label hosts). r6c3<K|]}|jywN)isdigit.0chs r) z(_host_derived_api_key..s :"9B2::<"9sr7)r::r)apiwwwc3DK|]}|jr|ndyw)_N)isalnumrZs r)r]z(_host_derived_api_key..sEfbjjl3fs )OPENAI OPENROUTEROLLAMA_API_KEY) r"anysplitpoplenjoinupperisalphar*r/)rRrTlbllabelsvendor sanitizedenv_names r)_host_derived_api_keyrwws&!*H  :(.."5b"9 ::>!SH_%^^C0 80cCc0F 8 VAY.0 1  VAY.0 6{QBZFEfEEKKMI IaL00266H%H Hb ! 'R . . 0059s C:C:c|sy ddl}|jd}|jds|dz }|j|dzd}|jrG|j jd g}t |d k(r|djd d}|r|Sy#t$r!}tjd ||Yd}~yd}~wwxYw) zFQuery a local server for its model name when only one model is loaded.r6rNrMz/v1z/models)timeoutdataidz$Auto-detect model from %s failed: %s) requestsr<rQgetokjsonrnrEloggerdebug)rRr~urlrespmodelsmodel_idexcs r)_auto_detect_local_modelrs Looc"||E" 5LC||C)OQ|7 77YY[__VR0F6{a!!9==r2#O  L  ;XsKK LsBB C#B??Cct}|jd}t|trt|}|jds|jdr|d|d<|jdxsdj }|jdxsdj }d|vxsd|v}| }|r|r|rt |}|r||d<|St|t r"|j rd|j iSiS)Nmodelr'r6rRr:r;)rr isinstancedictr/rstr)config model_cfgcfgr'rRis_local is_fallbackdetecteds r)_get_model_configrs ]F 7#I)T"9owwy!cggg&6 \C N779%+224GGJ'-2446(*EkX.E!k  /9H!)I )S!ioo&79??,-- Ir+c|xsdjj}|xsdjj}|sy|dk(r|dk(xs|jdS||k(S)aTCheck whether a persisted api_mode should be honored for a given provider. Prevents stale api_mode from a previous provider leaking into a different one after a model/provider switch. Only applies the persisted mode when the config's provider matches the runtime provider (or when no configured provider is recorded). r6TrAcustom:)r/r0 startswith)providerconfigured_providernormalized_providernormalized_configureds r)$_provider_supports_explicit_api_moderst$>r00288:06B==?EEG h&$0_4I4T4TU^4__ $7 77r+cht|jdxsdjj}t |jd}|rt d|r|St|jdxsdj}|sy ddlm}||| S#t$rYywxYw) Nrr6api_modecopilotr'chat_completionsr)copilot_model_api_mode)api_key) rrr/r0_parse_api_moderhermes_cli.modelsrrE)rrrconfigured_mode model_namers r)_copilot_runtime_api_modersimmJ7=2>DDFLLN%immJ&?@O? K^_Y]]9-34::rNbedrock_conversercodex_app_serverrOctt|tr(|jj}|tvr|Sy)z@Validate an api_mode value from config. Returns None if invalid.N)rrr/r0_VALID_API_MODES)rawrSs r)rrs2#sYY[&&( ) )  r+c|s|S|dvr|St|jdxsdjj}|dk(ry|S)uOptional opt-in: rewrite api_mode → "codex_app_server" for OpenAI/Codex providers when the user has explicitly enabled that runtime via `model.openai_runtime: codex_app_server` in config.yaml. Default behavior is preserved: when the key is unset, "auto", or empty, this function is a no-op. Only providers in {"openai", "openai-codex"} are eligible — other providers (anthropic, openrouter, etc.) cannot be rerouted through codex. Returns the (possibly-rewritten) api_mode.>openai openai-codexopenai_runtimer6r)rrr/r0)rrrruntimes r)%_maybe_apply_codex_app_server_runtimersV 11)-- 017R8>>@FFHG$$! Or+)rpool target_modelc 2|xs t}|xs|jdxsd}t|ddxst|ddxsdjd}t|ddxs t|dd}d} |d k(rd } |xst}n<|d k(rd } |xst }n)|d k(rd} |xst }n|d k(r d} |xsd}n|dk(r-d} tj|} |xs| r | jnd}n|dk(rd} t|jdxsdjj} d} | dk(r;t|jdxsdjjd} | xs|xsd}nF|dk(r |xst}n5|dk(rd } n,|dk(rd} n#|dk(r0t|t|dd} |xstdj}n|dk(rt|jdxsdjj} | dk(r]t|jdxsdjjd} | r| }t|jd} | r| } |r| dk7r ddlm}||}|r|} | dk(r-t%j&dd|}nt|jdxsdjj}tj|} | xr-|jd| jjdk(}||k(rA|r?t|jdxsdjjd} | r| }t|jd} |dvrddlm}|||} n | rt+||r| } nt-|}|r|} | dk(r|dvrt%j&dd|}t/|| |} || ||t|d d!||d"S#t"$rd}YwxYw)#Nr'r6runtime_base_urlrRrMruntime_api_key access_tokenrrrN xai-oauth qwen-oauthgoogle-gemini-clizcloudcode-pa://google minimax-oauthrO anthropicrhttps://api.anthropic.com openrouterxainousr azure-foundryrrazure_foundry_model_api_mode/v1/?$ opencode-go opencode-zenopencode_model_api_mode)rrrsourcer)rrrRrrcredential_poolrequested_provider)rrgetattrr<rrrrinference_base_urlrr/r0r rrrrrEresubrrrUr)rentryrrrreffective_modelrRrrpconfigrGrFrrinferredrpool_url_is_defaultrrs r) _resolve_runtime_from_pool_entryr1s70.0I$Ey}}Y'?E2O148bGE:W[<\b`bjjknoHe.5[XZ9[G!H>!$55 [ $99 \ !%44 ( (%66 _ $ (#''1Ng : :2 [ '9==4:;AACIIK  ; &y}}Z8>B?EEGNNsSLJ8J/J \ !22 U $ V % Y ,YGXZ\8]^N0;NN _ $9==4:;AACIIK ? *y}}Z8>B?EEGNNsSL'-immJ.GHO* x+?? J7H# + +vviX6H!)-- ";"ArBHHJPPR $''1%h(//#*>'B\B\BcBcdgBh*h ( */By}}Z8>B?EEGNNsSL'))-- *CD 6 6 B.xIH !EhPc!d&H 09H# ''H8W,W66)R25H H %620 g  s?P PPcn|r.|jr|jjSt}|jd}t |t r.|jr|jjSt ddjj}|r|Sy)z=Resolve provider request from explicit arg, config, then env.rHERMES_INFERENCE_PROVIDERr6auto)r/r0rrrrr*) requestedrrG env_providers r)resolve_requested_providerrsY__& &&((!#I==,L,$););)=!!#))++6;AACIIKL r+ct||}|sy t|}|jsy|j}|yt |ddxs t |dd}|sy||xst |xsd||d||dS#t $rYywxYw) zXCheck if a credential pool exists for a custom endpoint and return a runtime dict if so. provider_nameNrrr6rzpool:)rrrRrrr)r r has_credentialsselectrrUrE)rRprovider_labelapi_mode_overriderpool_keyrr pool_api_keys r)_try_resolve_from_custom_poolrs,HMRH "##%  =u&7>d'%Q_acBd &)e-Eh-OeSe #hZ(#    s"A=A=A= A== B B cndD]0}|j|}t|ts%|dkDs+||d<yy)aqPropagate a per-provider output cap onto the resolved runtime dict. Accepts ``max_output_tokens`` or ``max_tokens`` on a ``custom_providers`` entry so a provider block can pin its own output limit. Gateway and CLI map this onto ``AIAgent.max_tokens`` only when the top-level ``model.max_tokens`` isn't set, so the documented global key still wins. )max_output_tokens max_tokensrrN)rrint)rresult_k_vs r)_lift_max_output_tokensrs92 YYr] b# 26*,F& '  2r+c  t|xsd}|sy|dk(ry|dk7rM|jds< tj|}|xsdj j |k(ryt}|jd}t|tr|jD]\}}t|tst|}t|jddxsdj }|rt|dj nd} | s-t|jddxsdj } |||d|hvr|jdxs(|jd xs|jd xsd} | r|jd || j | |jd dd } |jd} t| trt| | d<t|jdxs|jd} | r| | d<t|| | cS|jd d}|st|}|||d|hvs|jdxs(|jd xs|jd xsd} | s|| j | |jd dd } |jd} t| trt| | d<t|jdxs|jd} | r| | d<t|| | cS|jd}t|trt j#dyt%|}|sy|D]}t|ts|jd }|jd } t|trt| tsXt|}d|}t|jddxsdj }|r t|nd}|rd|nd}|||||hvr|j | j t|jddxsdj d} t|jddxsdj }|r|| d<|r|| d<|jd} t| trt| | d<t|jd} | r| | d<t|jddxsdj }|r|| d<t|| | cSy#t $rYwxYw)Nr6rrAr providerskey_envrr`rrRr& default_model)r&rRrr extra_bodyr transportcustom_providerszcustom_providers in config.yaml is a dict, not a list. Each entry must be prefixed with '-' in YAML. Run 'hermes doctor' for details. provider_key)r&rRrr)r4rauth_modrr/r0rrrrritemsrr*rrrwarningr)rrequested_norm canonicalrrep_namer name_normrresolved_api_keyrRrrr display_name display_normrr&menu_keyrprovider_key_normprovider_menu_keyrs r)_get_named_custom_providerrs45G5M2NN "!.*C*CI*N  11.AIR&&(..0NB ]F ;'I)T"'oo/NGUeT*7@I%))Ir28b9??AG?Fww399;B ##&uyyB'?'E2#F#L#L#N '9 {6K!LL 99U+^uyy/?^599ZCX^\^ % &' :$,NN$4#3!&?B!? F "'|L !lLGL>BZ%[[$yy/b599U3CbuyyQ[G\b`bH$0(0(8'7%*YY%C " &+YY|%< %j$737 3CF<0#2599Z3H3bEIIVaLb#c#19F:./v>% u0zzz"45"D) / 6v> !%& yy 99Z($$Jx,E 3D9 YK(599^R8>B?EEG MY;LI_a=Ng&7%89TV )X7HJ[!\ \ JJL (599Y39r:@@B  eii 2.4"5;;=  'F9  %1F> "YY|, j$ '#' #3F< "599Z#89 !)F: 7B/526<<> (F7Ov. E"H C   sU U U c< t|duS#t$rYywxYw)u~Return True when config defines a custom provider matching the request. Thin public wrapper around :func:`_get_named_custom_provider` so other modules (e.g. the cronjob tool) can decide whether a provider name will actually resolve to a configured ``providers:`` / ``custom_providers:`` entry — without reaching into a private helper or duplicating the scan. NF)rrE)rs r)has_named_custom_providerrs*)*<=TII s  ct|}|sy t}|jd}t |t r|j D]x\}}t |t s|jdxs(|jdxs|jdxsd}t||k(sadtt|cS t|}|xsgD]r}t |t s|jd}t |tr|jsFt|jd|k(sddt|cSy#t$rYywxYw#t$rd}YwxYw) uDMap an endpoint URL back to its canonical ``custom:`` menu key. Returns the ``custom:`` slug of the first ``providers:`` / ``custom_providers:`` entry whose base_url matches, or ``None`` when no entry owns the URL. Session persistence stores the agent's *resolved* provider, and for every named custom endpoint that is the literal string ``"custom"`` — the entry name is lost, and the api_key is deliberately never persisted. The endpoint URL is the one durable fact that survives the round-trip, so this reverse lookup lets persist/rebuild paths recover the entry identity (and with it key_env/api_key/api_mode resolution via :func:`_get_named_custom_provider`) instead of failing with ``auth_unavailable`` or silently rebuilding with placeholder credentials. Nrr`rrRr6rr&) _normalize_base_url_for_matchrrErrrrr4rrr/) rRtargetrrrr entry_urlrr&s r)find_custom_provider_identityr sc +8 4F  ;'I)T"'oo/NGUeT* % SEIIe$4S *8MSQS -Y76A !@W!N OPP0 :6B"'R'%& yy $$DJJL  (:)> ?6 I`` identity for a bare custom provider. The bare string ``"custom"`` is the *resolved billing class* shared by every named ``providers:`` / ``custom_providers:`` entry — it is NOT a routable provider identity (``resolve_runtime_provider("custom")`` falls through to the OpenRouter default URL with no api_key, which surfaces to the user as "No LLM provider configured"). Any code path that persists or restores a session's provider override must run the resolved provider through this helper so a bare ``"custom"`` is upgraded back to its durable ``custom:`` menu key. Two recovery sources, in priority order: 1. ``base_url`` — reverse-lookup the entry that owns the endpoint URL (the one fact that always survives the persistence round-trip when a URL was recorded). 2. ``config_provider`` — the active ``config.model.provider`` (or its ``provider``/``HERMES_INFERENCE_PROVIDER`` equivalent). When the agent was built without a base_url on the override (the recurring Desktop/TUI regression vector), the configured provider is the only durable identity left, so fall back to it when it names a real entry. Returns ``custom:`` when a routable identity is recovered, else ``None`` (caller keeps whatever it had — bare ``"custom"`` only as a last resort, e.g. a genuine ad-hoc endpoint with no config entry). r6rr>rrArNr) r rr/rrrEosenvironr4rr)rRridentity candidatecandidate_norms r)canonical_custom_identityrs@0: OO)r*002I  -/33J?E2FLLNI JJNN#>CIIK 4Y?N ^/OO %i 0 <((3%%^,- - = % I     s)4C)CC CC C+*C+cvt|xsdjjdjS)Nr6rM)rr/r<r0r2s r)r r s. u{  ! ! # * *3 / 5 5 77r+cf|jd}t|tr|siSdt|iS)Nr)rrr)custom_providerrs r)"_custom_provider_request_overridesrs3 $$\2J j$ 'z $z* ++r+explicit_api_keyexplicit_base_urlc j|xsdjj}|r|dk7r ddlm}||dk(rd}|dk(r|r|jj d}t |dd}|rd|d<|St|dxs t|d }t|d }|xsdj|rtd djnd|rtd djndt|g} td | Ddxsd} dt|xsd|| d|dSt|} | sy|xsdjxs| jddj d}|syt |d| jd| jd}|rs| jd} | r| |d<t| jdtr| d|d<t!| } | r%it#|jdxsi| |d<|St|dxs t|d }t|d }|xsdjt%| jddxsdjtt%| jddxsdjdj|rtd djnd|rtd djndt|g} td| Dd} d| jdxst|xsd|| xsdd| jd|d}| jdr| d|d<t| jdtr| d|d<t!| } | r| |d<|S#t$rYswxYw)Nr6rArrBrMz direct-aliasr openai.comopenai.azure.comrCOPENAI_API_KEYOPENROUTER_API_KEYc38K|]}t|s|ywrXr)r[cs r)r]z0_resolve_named_custom_runtime..Qs C*1.?.BQ*no-key-requiredrrrrRrrrrRrr&rrrrequest_overridesrrc38K|]}t|s|ywrXr#r[rs r)r]z0_resolve_named_custom_runtime..sb/A)EVW`EaI/Ar%zcustom_provider:rrrRrr)r/r0rDrrEr<rr!r*rwnextrUrrrrrrr)rrrrrJrR pool_result_da_is_openai_url_da_is_openrouterapi_key_candidatesrrrr(_cp_is_openai_url_cp_is_openrouterrs r)_resolve_named_custom_runtimer3$s>).B557==?N.H4  M 0HP $"4   11CDO   b'') /   z2 . fSk  0(ODWDWXbDctCtGtGHNtOPK%((1 #-K o))*=> D/>?R/SK+ ,>O 0{':;ArB0#0K+ ,/,G~K`aik}K~//J  R&&( O   2 . 4"5;;=O'' 26<"=CCErJPPR7H!2 & , , .b6G%r * 0 0 2b h' b/AbdfgG#'' 3 #H - //$_%8%8AS%T$UVF7#)'2w/%%&9:C@&56I&J"#:?K&7"# MG   sN%% N21N2c Rt}t|jdtr|jdnd}t|jdtr|jdnd}d}dD]F}|j|}t|ts%|j s6|j }n|xsdj j } |j j }| r| dk7r ddlm} | | dk(rd} tddj } td dj } d } |j r$|s"| d k(r |r|d k(rd } n| dk(rt||rd } |xsdj xs$| xs | r|j ndxs | xstjd }t|d}|xs*| dk(xr#| xs|| k(xr|| xsdjd k(}|r|tdtdg}nbt|d}t|d}t|d}|| r|nd|r tdnd|s|r tdnd|r tdndt|g}td|Dd}|s|rdnd}| dk(rdnd}|dk(r4|r2t!||t#|jd| dk7r|nd}|r|S|dk(r|s|sd}|t#|jdxst%|xsd|||dS#t$rYwxYw)NrRr6r)rr`rArrBr CUSTOM_BASE_URLFrTrMrCrr!r z ollama.comrrOLLAMA_API_KEYc3nK|]-}t|st|xsdj/yw)r6N)rrr/r*s r)r]z._resolve_openrouter_runtime..s.j7I)M^_hMiY_"  # # %7Is5"5explicitz env/configrrr&rr+)rrrrr/r0rDrrEr*rKr r<r!rwr,rrrU)rrrrrFrG cfg_api_keykvrrJenv_openrouter_base_urlenv_custom_base_urluse_config_base_urlrR_is_openrouter_url_is_openrouter_contextr0_is_ollama_url_is_openai_url_is_openai_azurerreffective_providerr-s r)_resolve_openrouter_runtimerEs "#I0:9==;TVY0Z9==,`bL0:9==;TVY0Z9==,`bLK  MM!  a !'')'')K   ).B557==?N%%'--/L .H4  M 0H>@  $5 V #<6#9&*# x ',X ,- #'   b'')   $7L   R  #   fSk  /xI0,& D $ K4K(K D 06B>>sC C   ( ) $ % 2(LI1(LI1((0J,PT   X%g>P#'#IMM*$=> #H -  K   sL L&%L&)rrrc t|xsdj}t|xsdjjd}t|jdxsdjj }d}d}d} i} |dk(rt|jdxsdjjd}t |jdxsd}t|jd xsdjj xsd} |jd } t | tr| } t|xs|jd xsdj} | r|d k7r d dlm } | | }|r|}tddjjd}|xs|xs|}|s td|d k(rtjdd|}| dk(r|r|}d}d}nT d dlm}m}m}t| jdxsdjxs|} ||}||}|}d}d}i}|dk(r3t| jdxsdj}|r||d<d|||||||dS|}|s d dlm}|dxsd}|stddj}|s td|s|rdnd}d|||d||d S#t$rd}YgwxYw#t$r}td|d|d}~wwxYw#t&$r}tt||d}~wwxYw#t$rd}YwxYw)!aResolve an Azure Foundry runtime entry. Reads ``model.base_url`` + ``model.api_mode`` from config.yaml (or explicit overrides), pulls the API key from ``.env`` / env var, and strips a trailing ``/v1`` for Anthropic-style endpoints because the Anthropic SDK appends ``/v1/messages`` internally. When ``model.auth_mode == "entra_id"`` (and the model is OpenAI-style), the returned ``api_key`` is a zero-arg callable produced by :func:`agent.azure_identity_adapter.build_token_provider` rather than a string. Downstream code that constructs an OpenAI SDK client passes this through unchanged (the SDK accepts ``Callable[[], str]`` for ``api_key`` and calls it before every request). Code paths that need a string (logging, manual HTTP probes, header injection) must use the helpers in ``agent.azure_identity_adapter``. Raises :class:`AuthError` when required values are missing. r6rMrrrrrRr auth_modeentrar'rOrrNAZURE_FOUNDRY_BASE_URLzpAzure Foundry requires a base URL. Set it via 'hermes model' or the AZURE_FOUNDRY_BASE_URL environment variable.rentra_idr8)EntraIdentityConfigSCOPE_AI_AZURE_DEFAULTbuild_token_providerzAzure Foundry Entra ID auth requires the 'azure-identity' package. Install it with: pip install azure-identity (import failed: )scope)rO)r)rrrRrrGrHrr) get_env_valueAZURE_FOUNDRY_API_KEYaAzure Foundry requires an API key. Set AZURE_FOUNDRY_API_KEY in ~/.hermes/.env or run 'hermes model' to configure. To use keyless Microsoft Entra ID auth instead, set model.auth_mode: entra_id in config.yaml (or pick 'Microsoft Entra ID' in 'hermes model').r)rrrRrrGrr)rr/r<rr0rrrrrrEr*rrragent.azure_identity_adapterrKrLrM ImportErrorhermes_cli.configrP)rrrrrexplicit_base_url_cleanrGrF cfg_api_mode cfg_auth_mode cfg_entra_entrarrr env_base_urlrRrrrGrKrLrMrrO entra_configtoken_provider clean_entraconfigured_scoperPs r)_resolve_azure_foundry_runtimer_+s4+1r288:!"3"9r:@@BII#Ny}}Z06B7==?EEGLL%LM "I&9==4:;AACJJ3O &y}}Z'@AWEW IMM+6C)DJJLRRTaXa w' fd #I,H)-- *BHbIOOQO<+??  F3ODH #L3R8>>@GGLL&F,F,H  ?  ++66)R2  " ,GF!I IMM'*0b1779*)  32  "6\!J%GF"I  ""9==#9#?R@FFH '7 G$($ " "4  G   7#$;<BG 126<<>  7  -0AZF# 0 S H \ ''*e1.    3C)s2 3: G sTK* K<;LM* K98K9< LLL M&L;;M MMc ht|xsdj}t|xsdjjd}|s|sy|dk(rt|jdxsdjj }d}|dk(r;t|jdxsdjjd}|xs|xsd}|}|sddlm} | }|s td dd ||d |d S|d k(rn|xst}|}d} |sTt} | jdd}| jd} |s%| jddjdxs|}d d||d | |dS|dk(rQtjdxsi} |xsIt| jdxstjjjd}|xsNt| tdtddr,t| jdxsdjnd}| jdxs| jd} |sit!t#t%dd} | jdd}| jd} |s%| jddjdxs|}dd||d | |dS|dk(rt'|||| St)j|}|r<|j*dk(r,d}|j,r3t%|j,djjd}|}|sA|d!vr-t/|} | jddjd}n|xs |j0}|}|s@t/|} | jdd}|s!| jddjd}d}|d"k(r t3||}n6|d#k(rd}n.t5|jd$}|r|}nt7|}|r|}|||jd|d |d Sy)%Nr6rMrrrRrrresolve_anthropic_tokenNo Anthropic credentials found. Set ANTHROPIC_TOKEN or ANTHROPIC_API_KEY, run 'claude setup-token', or authenticate with 'claude /login'.rOr8r'rr last_refreshrNrrrRrrrdrrr<HERMES_NOUS_MIN_KEY_TTL_SECONDS agent_keyagent_key_expires_at expires_atHERMES_NOUS_TIMEOUT_SECONDS15timeout_secondsrrrrRrrrkrr)rrrr> kimi-codingkimi-coding-cnrrr)rr/r<rr0agent.anthropic_adapterrbrrrrget_provider_auth_stateDEFAULT_NOUS_INFERENCE_URLrmaxr#rfloatr*r_r auth_typebase_url_env_varrrrrrU)rrrrrrGrFrRrrbrdcredsstaterkrenv_urlrrrs r)_resolve_explicit_runtimer}sg+1r288:-34::<CCCH $5;9==4:;AACIIK  ; &y}}Z8>B?EEGNNsSL$S S8S" G-/GV $,  "4   >!$>(>" 57Eii 2.G 99^4L$ 99Z4;;C@LH&)  ("4  6008>B  o59912Yh6Y6YZ``biijmn # #B A4HI  +&," - 3 3 5  YY56Q%))L:Q 4 %g.KT&R SEii 2.G<0J$ 99Z4;;C@LH*  $"4  ?"-1-/    ##H-G7$$ 1  # #g66;AACJJ3OG$<<k(r,d?d@l"m#}|}| d|d|d)|jd*dA|d S| dBk(rv tI}dBd(|jdd|jd)d|jd*dC|jd:|jdDd|jdEd|dF S| dHk(rtK| }dHd(|jddjd|jd)d|jdIdtM|jdJxsg|jd*dK|dLS| dk(rt| jdxsdjj} d}| dk(r2| jdxsdjjd}|xsdM}d|jvxs|xrd|jv}|rd}dND]O}t| j|xsdj}|s2t|dj}|sOn|s,t| jd)xsdj}|s6tddjxstddj}|s%t5dOd?dPl'm(} | }|s t5dQdd||dR|d S| dSk(rEd?dTl)m*}!m+}"m,}#m-}$|dUv}%|%s|!s t5dVdWXt]jdSi}&|&jdYxsdjxs|#}'|"xsdZ}(|&jd[i})d}*|)jd\rN|)jd]r=|)d\|)d]d^}*|)jd_r|)d_|*d`<|)jdar|)da|*da<t| jdbxsdj}+|$|+rdSddc|'ddde|(|'d|df},ndSdgdc|'ddde|(|'|dh},|*r|*|,di<|,StAj| }|r|jBd)k(rt_| }t| jdxsdjj} d}| | k(r2| jdxsdjjd}|xs!|jddjd}d(}-| djk(rta| |jd)d}-n| dkk(rd1}-nt| jdxsdjj}.tc| jdl}/| dmvr&d?dnl2m3}0|xs| jdbd}1|0| |1}-n |/rti| |.r|/}-ntk|}2|2r|2}-|-dk(r| dmvrtmjndod|}| |-||jd)d|jd*dR|d Stq||| },||,d <|,S#t$rd}YwxYw#t4$r|d.k7rt*j7d/YwxYw#t4$r|d.k7rt*j7d5YlwxYw#t4$r|d.k7rt*j7d7Y$wxYw#t4$r|d.k7rt*j7d<YwxYw#t4$r|d.k7rt*j7dGY@wxYw)pa)Resolve runtime provider credentials for agent execution. target_model: Optional override for model_cfg.get("default") when computing provider-specific api_mode (e.g. OpenCode Zen/Go where different models route through different API surfaces). Callers performing an explicit mid-session model switch should pass the new model here so api_mode is derived from the model they are switching TO, not the stale persisted default. Other callers can leave it None to preserve existing behavior (api_mode derived from config). r6rz azure.comAZURE_ANTHROPIC_KEYANTHROPIC_API_KEYrOrMzazure-explicitr'r)rrrrr)rrrrr)rrrrrrrrROPENAI_BASE_URLr >rrAT>rrNrrrrfrgrhrirjrO)rirjrOzPNous pool entry agent_key expired/missing, falling through to runtime resolution)rrrrrrrlrmrnrrrportalrkrprzUAuto-detected Nous provider but credentials failed; falling through to next provider.rrNzhermes-auth-storerdrezVAuto-detected Codex provider but credentials failed; falling through to next provider.rzZAuto-detected xAI OAuth provider but credentials failed; falling through to next provider.rzqwen-cli expires_at_ms)rrrRrrrrz@Qwen OAuth credentials failed; falling through to next provider.r oauth_minimaxr))resolve_minimax_oauth_runtime_credentialsoauthrz google-oauthemail project_id) rrrRrrrrrrzIGoogle Gemini OAuth credentials failed; falling through to next provider.z copilot-acpcommandargsprocess)rrrRrrrrrr)r api_key_envzNo Azure Anthropic API key found. Set AZURE_ANTHROPIC_KEY or ANTHROPIC_API_KEY, or point key_env/api_key_env in your config.yaml model section at a custom env var.rarcenvbedrock)has_aws_credentialsresolve_aws_auth_env_varresolve_bedrock_regionis_anthropic_bedrock_model> aws-bedrockamazon-bedrockawsamazonrzNo AWS credentials found for Bedrock. Configure one of: - AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY - AWS_PROFILE (for SSO / named profiles) - IAM instance role (EC2, ECS, Lambda) Or run 'aws configure' to set up credentials.no_aws_credentials)coderegionzaws-sdk-default-chain guardrailguardrail_identifierguardrail_version)guardrailIdentifierguardrailVersionstream_processing_modestreamProcessingModetracer'zhttps://bedrock-runtime.z.amazonaws.comzaws-sdk)rrrRrrrbedrock_anthropicrr)rrrRrrrrguardrail_configrrrrrr)9rr/r*r<r_rr3rr}rrr0boolr rErrrrvr#rrrrrrwrinforrrrrrxrDrrrlistrsrbagent.bedrock_adapterrrrrrrrrrrrrUrrrE)3rrrrr _eff_base _azure_key azure_runtimecustom_runtimerrexplicit_runtimeshould_use_poolrGrFenv_openai_base_urlr<has_custom_endpointhas_runtime_overriderrrmin_ttl nous_staterzrrrR_is_azure_endpointtokenhint_keyenv_varrbrrrr is_explicit _bedrock_cfgr auth_source_grr_current_modelrrrrr _effectivers3 r)resolve_runtime_providerrls "4I> #(b//1I[([I-E  # * * , 8,b1779 8*B/557  $,!((-!&"4   _,61')-/%  2-)+N /A+,)+H "#I0-)+ ,.O<9==4:;AACIIK 9==4:;AAC %&7<BBD")*?"D"J"J"L"  '" '&  L,>>"& #$4$I8IJ "8 8 )'' )((  &5y"4 $$&   0$765."5  v %"3 "g&GNOG$UK>(/7Mt(T 6J ( G< op!  3!#5#)  6 =4 %g.KT&R SE#.!IIj"5<! =57E*-!IIj"5<E/.!IIj"5 99Y3))Hn=!&?!;7B/#ii b9&8  "= =hG%* *b188=yyB/yyB/6*0b1ii)4"4  ;9==4:;AACIIK  ; &%MM*5;BBDKKCPL>#>)HNN,<<  @[L,>,>,@@  E6immH5;<BBD#GR0668E 7IMM)4:;AAC126<<>@2B7==?E H+-EV $, "4   9  ),ii #6#8@ *  #}((B7 ""8,299;W?U?W.0K4K {B/ 77) *sww7J/K'*+A'B$'(;$<  ww/0;>?W;X !78www,/L )Y]]95;<BBD %n 5&06vhnM$% %)&8 G&.6vhnM$% &8G *:G& ' ##H-G7$$ 14X> 9==4:;AACIIK  8 #%MM*5;BBDKKCPLH599Z#<#C#CC#H% y 0EIIiQSrsM" !&&   8 $'kk8$K0CC /3= 5<861r.,8""$ (   >+/%)"&FF F F ( F # F FFR,(,#' %!   @ Zz 0j#%)<<#< <~8,'+'+ xx$x% x  x|'+'+ II$I% I  I`'+'+"& fff$ f % f  ff\'+'+ UUU U $ U % UUt $&*'+"& LL$L% L  L  L^r+