a7c44e9ededd7c445897be4afa48de209bd5c7cd
418 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
kshitijk4poor
|
754ea72538 |
refactor(credential_pool): collapse the stale-writer early returns
`_credential_token_pair` already maps a non-dict row to (None, None), so the separate isinstance guard and second early return in `_merge_pool_row_generation` were the same branch. Adopting a peer generation now goes through the existing `_replace_entry` swap primitive. |
||
|
kshitijk4poor
|
d525b443f5 |
refactor(auth): one token-base helper with one blank-row policy; dedupe generation copy loop
The id->token-pair base map was built three ways: _persist dropped (None, None) pairs, load_pool and _sync_entry_from_pool_store kept them. _merge_pool_row_generation treats a missing base as "unknown" (plain recency merge) but a (None, None) base as a known generation, so a token-less row got the generation override on the first flush after load_pool and the plain merge on every later one. Policy chosen: KEEP blank bases everywhere (new auth_mod._token_pairs_by_id, built on the existing _entry_ids). A blank base means "no pair when we last looked", which is exactly the CAS witness the boundary needs: when a peer lands a pair on that row, every flush of ours keeps the peer's generation instead of writing our blank tokens back. Dropping blank bases would make the first flush keep the peer's pair and later flushes overwrite it. _sync_entry_from_pool_store now records the base before its no-token- material bail-out so all three sites agree. _update_root_pool_rows reuses _entry_ids for its incoming map as well. Also collapse the three copy-from-disk-else-pop loops in _merge_pool_row_generation into a local _take_from_disk helper. failure_reason is passed alongside _POOL_STATUS_FIELDS rather than added to the shared constant, which auth_codex/auth_oauth_grants and _merge_disk_cooldown_state also consume. |
||
|
kshitijk4poor
|
badd8f56e4 |
fix(auth): scope only terminal DEAD verdicts to the stale token generation
When a stale pool's persist finds the disk pair moved, #120943 copied every status field from disk, so the stale writer's NEWER account-wide verdict (402 billing / 429 throttle -> EXHAUSTED) was erased and the rotated pair re-entered selection immediately. Only a terminal auth death is tied to the pair it was observed on: discard the stale writer's DEAD onto the peer's pair, but leave any other status for _merge_disk_cooldown_state's ordinary recency merge. Also travel `scope` and `inference_base_url` with the pair (a Nous refresh rewrites them together with the tokens, so a stale writer must not stamp an old scope/route onto the newer pair); use the always-initialised _persisted_token_pairs directly; and re-hydrate an in-memory entry from the written row only when the store overrode its pair, so unchanged rows keep runtime-only fields to_dict() omits. Tests: fold the stale-later-402 witness (rt-1 kept AND last_status == exhausted) into the stale-terminal-verdict test and drop the separate 429 rollback test it subsumes. Fixes #120815 Co-authored-by: John Paul Soliva <soliva.johnpaul@icloud.com> |
||
JoaoMarcos44
|
d2f54de2cc |
fix(auth): bind stale pool writes to token generation
(cherry picked from commit 1f5c7bcd076cd6184fb048ea1a57c4549f5f4991) |
||
teknium1
|
327dc2a721 |
refactor(config): move read-failure reporting into hermes_cli/config_read_errors.py
The parse-failure banner, the active-failure record, FailedConfigRead and the write refusals are one topic; config.py had grown past 4,100 lines with this PR. Pure move (no behaviour change): config.py drops to 3,999 lines, below origin/main. Callers outside config.py now import from the new module. |
||
|
kshitijk4poor
|
a25542c695 |
refactor(codex): keep the read-only quota guard, drop the preserve_corrupt plumbing
The principal-keyed fingerprint runs resolve_codex_runtime_credentials(read_only=True) on every cache-only picker read, so the pool-exhausted branch must not probe the usage endpoint or clear cooldowns from that path: one `not read_only and` guard, kept with its test. The preserve_corrupt flag threaded through six auth loaders only suppressed the one-time .json.corrupt sidecar copy on an unparseable store — an edge case the same read-only resolve already hits on main via _codex_catalog — so it goes. |
||
KCAYAAI
|
4ae78e3979 |
fix(models): keep Codex catalogs across token rotation
(cherry picked from commit 92b3a8af51010f0764f264a28bb45e4f19152edb) |
||
|
teknium1
|
0706dffca1 |
fix(config): route every config.yaml writer through one comment-preserving writer
`hermes_cli.config.atomic_config_write` is now THE config.yaml writer: it delegates to `utils.atomic_roundtrip_yaml_save` (ruamel round-trip), which merges the new state onto the on-disk document so user comments, key order, quoting and blank lines survive every write. Why: config.yaml is hand-edited and commented, and every writer that re-serialised the parsed dict through PyYAML (`save_config`, `config set/unset`, migrations, plugin bookkeeping, auth provider reset, credential scrub, channel strip, backup restore, profile seed, telegram topic persistence) destroyed those comments — and `save_config` re-appended the stock boilerplate on top (#92554, #63039, #50698, #109611, #107511, #66752). The round-trip writer existed (tui_gateway only) but nothing else used it, so each new writer regressed the class. - save_config / _write_user_config / atomic_config_write -> round-trip merge; the commented example blocks are appended only when the file is created. - round-trip merge only reassigns nodes whose value changed (element-wise for lists), so an untouched scalar/list keeps its inline comments; YAML 1.1-ambiguous strings (off/yes/no...) are force-quoted at every depth; duplicate keys are tolerated like PyYAML. - direct PyYAML writers in auth.py, credential_lifecycle.py, profile_channels.py, backup.py, profiles.py, telegram adapter and tui_gateway/server.py now call atomic_config_write. |
||
|
teknium1
|
2632229bcf |
fix(auth): named profiles read the root auth.json again (revert #111724)
Reverts
|
||
|
kshitijk4poor
|
1d27f076c8 |
refactor: merge openrouter rung into the registry rung in _config_model_provider
Both rungs return (model_cfg, provider) verbatim, so a single `provider == "openrouter" or provider in PROVIDER_REGISTRY` condition reads as one intent: an explicit pin on a known aggregator/registry provider. The 2-line WHY comment stays because openrouter's absence from PROVIDER_REGISTRY is deliberate (#109397, #10622) and the merged condition would otherwise look like a mistake. Also move `base_url = ...` back down to just above `if base_url:`. The hoist was only needed while the openrouter rung inspected base_url; since f57fbfbb46 that rung honours mirrors unconditionally, so the early read is dead and the assignment belongs next to its sole consumer. |
||
|
kshitijk4poor
|
b4b9a9a00e |
refactor: trim boot-inventory rung comments in _config_model_provider
The three picks for #109397 left two ~8-line comment blocks inside _config_model_provider explaining the openrouter and bare-named-provider rungs. Cut each to two lines and state both cases in the function docstring instead, so the intent is visible where the function is documented rather than buried mid-body. Comment/docstring only; no logic change. |
||
Everson Menezes Santos
|
907bf871d2 |
fix(auth): recognise a bare named providers: pin in boot inventory
A bare `model.provider` naming an enabled `providers:` / `custom_providers:` entry was discarded by _config_model_provider(), even though the runtime resolver routes it (has_named_custom_provider() -> True) and `hermes chat` works against the endpoint. The two paths disagreed: free_tier_bootstrap._inventory_other_providers() recorded provider_configured=False, so the dashboard parked sessions on Setup Required for a working config — the same #109397 symptom one rung over from the openrouter pin. Reuse the runtime's own lookup after the registry check. has_named_custom_provider() is narrower than a raw providers-key check: it skips disabled entries and entries without a usable endpoint, and covers the legacy custom_providers: spelling. Regression test uses a real temp HERMES_HOME; red on the unfixed rung. (cherry picked from commit 5567d685131f986bfe7c73485e906a22d7ff1151) |
||
|
Everson Menezes Santos
|
a74a258642 |
fix(auth): honour openrouter mirror base_url in boot inventory
Review follow-up: the explicit model.provider: openrouter pin is provider intent regardless of the base_url host, because the runtime treats a non-openrouter base_url under the openrouter pin as a deliberate mirror/proxy (runtime_provider_backends.py #10622, pinned by test_explicit_openrouter_honors_config_base_url_mirror). Preserve that intent instead of rejecting the mirror and parking the dashboard on Setup Required. Also correct the stale-base_url regression example: a non-loopback base_url under a bare (unpinned) provider is the '#14676 stale leftover' case; an openrouter pin is the one provider where a foreign host is a legitimate mirror, not staleness. Add the mirror URL to the bootstrap regression coverage and map the contributor email for the attribution gate. Refs #109397 (cherry picked from commit f59e511118861c168da7d5c64f4b5c8640de8b61) |
||
|
Everson Menezes Santos
|
34d7206376 |
fix(auth): recognise model.provider openrouter in boot inventory
_config_model_provider() treats a configured 'custom' endpoint as explicit provider intent but not 'openrouter', which (like 'custom') is intentionally absent from PROVIDER_REGISTRY. An openrouter-pinned install therefore read as "nothing configured" in the free-tier boot inventory, parking dashboard sessions on Setup Required while 'hermes chat' worked. Recognise the openrouter pin the same way, honoring the existing stale-base_url guard: only a canonical (empty or openrouter.ai) base_url counts; a non-openrouter base_url under the openrouter pin stays contrived config and is rejected. Fixes #109397 (cherry picked from commit 10e030812c5d1f6d4b44ec69d3b30c7b13b157e7) |
||
Austin Pickett
|
1a1f4a59e2 |
fix(auth): explicit-provider gate uses the credential resolver's reader
get_env_value stops at the first environ hit, so a shell that exports DEEPSEEK_API_KEY= (empty) hides a real key in .env from the gate while resolve_api_key_provider_credentials() finds it: the picker omits a provider the chat path would authenticate with. Read through get_env_value_prefer_dotenv, the same chain auth.py already uses to resolve the key, so the two can never disagree (#77007). Co-authored-by: webtecnica <webtecnica@gmail.com> |
||
xxxigm
|
4ea57fa61b |
fix(auth): count profile .env keys in the explicit provider gate
os.getenv saw only the launch profile, so a DeepSeek key pasted in another profile never appeared in Settings → Model until Refresh models ran against that Bot's own backend. |
||
|
teknium1
|
265e68d784 |
fix(auth): one primary_failure_wording() helper labels quota vs auth failure at all three fallback surfaces
- hermes_cli.auth.primary_failure_wording(exc) -> (log, user) phrase; reused by cli_agent_setup_mixin._resolve_fallback_runtime, runtime_provider's fallback logger and the TUI gateway/Desktop _resolve_runtime_with_fallback (#117482 sibling: 'Primary auth failed' for a 429 on the gateway surface). - Drop the dead credentials_rate_limited kwarg at the post-turn exit site (the flag is only True when _ensure_runtime_credentials returned False). - Fold the new tests: 2 parametrized production-path tests + 1 gateway test. |
||
|
teknium1
|
d03b5f3770 |
fix(auth): skip the Copilot token exchange while copilot is only an ambient gh-CLI credential
load_pool("copilot") exchanged the gh CLI token on every load — on installs where copilot is
never selected (main provider deepseek, aux slots auto) that is a network round-trip plus the
"degraded to RAW token" warning on every pool load, ~2 per turn, 1000+ times in five days for
the reporter (#114740). The exchange result only matters once a model is routed to copilot, so
the seeder now keeps the raw token and skips the exchange (and the warning) until
is_provider_explicitly_configured("copilot") is true; the load that follows the user selecting
copilot re-seeds and exchanges as before. auxiliary.<task>.provider now counts as selecting a
provider in _config_selects_provider, like a MoA slot, so an aux slot pinned to copilot still
gets the exchanged token. Contributor tests trimmed to two invariants.
|
||
treatux
|
3335319fe4 |
fix(auth): reject the placeholder secrets this repo ships as examples
has_usable_secret() only knew the exact string "your_api_key_here", so every other placeholder this repo ships counted as a configured credential: - .env.example ships ``your_key_here`` (Xiaomi, Upstage, Ramp Router, Nebius) and ``your_google_ai_studio_key_here`` / ``your_gemini_key_here`` / ``your_ollama_key_here`` (Google AI Studio, Gemini, Ollama); - the quickstart and the MCP/skill references use sk-xxx / ghp_xxx / hf_xxx. A copied-but-unfilled .env therefore resolved as a configured provider and the placeholder went upstream, producing an opaque 401 instead of the "no usable credentials — set X" the read point is required to report (AGENTS.md, "Fail loud at integration boundaries"). Reject both shipped placeholder shapes, and apply the same gate in _resolve_from_pool(), which handed a pooled placeholder straight to the client. Tests cover every placeholder .env.example ships, the x-run convention, and a pooled placeholder that must behave exactly like no credential at all. |
||
|
teknium1
|
e5e7fbcd27 |
fix(auth): a user provider plugin's endpoint overrides the bundled row too
A `$HERMES_HOME/plugins/model-providers/<name>/` plugin re-registering a bundled provider (stepfun with a regional base_url, gmi at a staging host) wins in `providers._REGISTRY` — register_provider() is last-writer-wins and the plugin guide promises exactly this — but the runtime reads its endpoint from `hermes_cli.auth.PROVIDER_REGISTRY`, whose mirror loop skipped every name already present, so inference kept going to the built-in URL (#48450). The mirror now applies one explicit precedence rule: when a row core wrote (built-in or plugin-mirrored) belongs to a name whose profile currently registered came from a USER plugin, the row's profile-derived fields are rewritten in place (inference_base_url; api_key_env_vars / base_url_env_var on api-key rows when the profile declares env_vars). `providers` records the discovery source per registration (`provider_source()`), because a bundled profile must never rewrite a built-in row: several bundled profiles omit the row's `*_BASE_URL` env var and one differs in auth_type, so an unconditional "profile wins" would have changed built-in behaviour. With no user plugin PROVIDER_REGISTRY is byte-identical before/after (78 rows probed). copilot/kimi/zai keep their bespoke resolution via the existing skip set. Co-authored-by: xiaoxinova <xiaoxinova@users.noreply.github.com> |
||
|
teknium1
|
f7240ca980 |
fix: admitted plugin providers are selectable and status-accurate on every surface
Picker admission (#116552) listed out-of-tree external-process and OAuth plugin providers, but selection and status still dispatched through provider-name tables: - `hermes model`: no `_PROVIDER_MODEL_FLOWS` entry and no generic flow, so picking an admitted plugin row was a silent no-op. One generic flow in model_setup_flows.py, credential step keyed by the profile's auth_type (external_process -> launch check; oauth_* -> live pool row, else the `hermes auth add <name>` hint), catalog via merge_profile_catalog; main.py falls back to it for any registered profile missing from the table. - `_STATUS_BY_AUTH_TYPE` had no builder for oauth_device_code/oauth_external, so `get_auth_status`/`list_available_providers().authenticated` stayed False with a live pool entry. `get_plugin_oauth_auth_status` (auth_plugin_providers sibling) reads the pool; gated on PLUGIN_MIRRORED_PROVIDERS so bundled OAuth providers keep their bespoke status bytes. - `_external_process_auth_evidence` computed evidence for copilot-acp only, so `inventory._external_process_signed_in` hid every other ACP row from the Desktop explicit_only picker. Generic evidence = the binary resolves; the bundled CLI keeps its token-store chain. - agent_init Responses-upgrade guard dropped the vendor literal redundant with the acp:// scheme check. - `fetch_account_usage` bounds the plugin hook with a shared 10 s deadline (previously only the CLI wrapped the call; gateway/TUI awaited unbounded), contextvars-propagated so scoped secrets resolve; overrun -> None. Part of #116408 (cherry picked from commit 536a4e7fcf2d1ac2b8a70bd62a69707d58ea5d1e) |
||
|
teknium1
|
dce233e809 |
feat(auth): OAuth-shaped provider plugins register, log in and refresh through their profile
An out-of-tree ProviderProfile with auth_type oauth_device_code/oauth_external loaded and inferred but was invisible to hermes auth: _register_plugin_provider skipped every auth_type except external_process and api_key, so resolve_provider() said "Unknown provider", `hermes auth add` had nothing to dispatch to, the pool could not refresh its rows (REFRESHABLE_OAUTH_PROVIDERS is a name set) and PooledCredential.from_dict dropped every extra key outside _EXTRA_KEYS on reload. - hermes_cli/auth_plugin_providers.py (new sibling; auth.py is at the size cap): the registry mirror now registers every profile under the auth_type it declares, re-syncs after discovery / on a miss (salvaged from #101768), and owns the seam lookups: auth_handler dispatch, the fail-loud error for a non-api-key profile that ships no handler, and refresh eligibility derived from the profile's refresh_credential hook (never a name set). - providers/base.py: ProviderProfile.auth_handler(action, args) (salvaged from #111610, sync only) and refresh_credential(entry) -> rotated fields. A separate hook rather than auth_handler("refresh", ...) because the pool holds a credential row, not an argparse namespace, and needs tokens back rather than a bool. - hermes_cli/auth_commands.py: add/status/logout/refresh (incl. interactive add) consult the plugin handler before the built-in path; `auth refresh` admits plugin rows via the predicate. - agent/credential_pool.py: _refresh_entry_impl calls the profile hook; from_dict keeps every non-field key in extra so plugin metadata survives load -> save -> load (to_dict already wrote it all; sanitize_borrowed_credential_payload semantics unchanged). - hermes_cli/auth.py: config import moved below PROVIDER_REGISTRY (salvaged from #94231) so a plugin imported during discovery never sees a partial auth module. Built-in providers are untouched: only custom/openrouter were unregistered profiles before and both stay in the skip list; anthropic/nous/openai-codex auth add/status/refresh output is byte-identical in the before/after probe. Part of #116408. Salvages #111610 (@Finn763), #101768 (@zihaofeng2001, absorbing #106361 by @Finn763) and #94231 (@Kyzcreig). Co-authored-by: finn763 <165816600+finn763@users.noreply.github.com> Co-authored-by: zihaofeng2001 <zihaofeng2001@gmail.com> Co-authored-by: Kyzcreig <9063726+Kyzcreig@users.noreply.github.com> |
||
Kyzcreig
|
30b0958a69 |
fix(auth): defer hermes_cli.config import until after PROVIDER_REGISTRY exists
hermes_cli.auth imports hermes_cli.config at module top; config runs provider-plugin discovery at import time (module-level provider imports + _inject_profile_env_vars), so plugins can execute against a partially initialized auth module during TUI startup — anything they try to register/inspect on auth silently loses to fallback metadata. Move the config import below ProviderConfig/PROVIDER_REGISTRY and document the ordering contract. Regression test spawns a clean interpreter with a probe plugin and asserts its registration lands (red before this fix, green after). |
||
zihaofeng2001
|
04f80dba0d |
fix(auth): re-sync plugin providers into PROVIDER_REGISTRY after discovery
hermes_cli.auth mirrors provider-plugin profiles into PROVIDER_REGISTRY once, at import time, by iterating list_providers(). providers' _discover_providers() sets its _discovered guard before importing the plugin directories, so when a plugin's own imports pull hermes_cli.auth in mid-discovery (e.g. a user plugin importing agent.credential_pool), the import-time mirror sees a partial profile list and every plugin discovered afterwards is dropped from the auth registry. resolve_provider() then rejects those providers with "Unknown provider" even though get_provider_profile() and resolve_provider_full() know them. - auth.py: factor the mirror into idempotent sync_plugin_provider_registry() (returns the number of newly mirrored profiles) and re-sync on a miss via _registry_lookup() at the resolve_provider() gate, is_known_auth_provider(), the get_auth_status() dispatch and the credential/status resolvers. - providers/__init__.py: call back into hermes_cli.auth (through sys.modules, never importing it, never raising) when discovery finishes and on any post-discovery register_provider(), so direct PROVIDER_REGISTRY readers stay correct too. Registrations *during* discovery are deliberately not mirrored one by one. - tests: subprocess end-to-end regression (sorted-first plugin imports hermes_cli.auth, sorted-last plain plugin must still resolve) plus in-process contract tests: partial snapshot reconciled at discovery end, post-discovery registration mirrored, sync idempotent / never clobbers, providers-side hook never imports hermes_cli.auth. All red on main. Fixes #102123. Absorbs the in-process tests and never-raise hook shape from #106361 (Finn763). Related: #21685, #69576, #94231. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AwbHcHDBh9vFRHSDj2W2FY |
||
|
teknium1
|
a564f77746 |
fix(auth): hermes auth reset survives a live session's next pool flush
A running gateway/chat holds the credential pool in memory. When the CLI resets a still-binding cooldown from another process, the reset row on disk has no status at all, so the recency merge in write_credential_pool (which ranks by last_status_at) could not tell "reset after my cooldown" from "never had a status" and let the live pool's stale EXHAUSTED entry win on its next ordinary flush - a rotation, a token refresh, a sibling 429. `hermes auth reset` printed success and the cooldown came back (#89415, step B in the thread). status_cleared_ids only protects the resetting write itself. reset_status/reset_statuses now stamp status_cleared_at on the cleared row. The disk-cooldown merge adopts the disk row whenever the in-memory entry is DEAD/EXHAUSTED and that marker postdates its last_status_at, and _resync_stale_entry lifts the in-memory cooldown from the same marker, so the live session serves the credential again without a restart. The marker is sticky but only outranks OLDER statuses: a fresh exhaustion after the reset stamps a newer last_status_at and still binds. Live probe (temp HERMES_HOME, fake Codex entry, process A = live pool, process B = real auth_reset_command): before, disk read `exhausted` again after A's flush and A re-selected None; after, disk stays clear and A re-selects the entry (mem ok). Control: reset then a new 402 stays exhausted through flush and re-select. |
||
|
Teknium
|
63bcdcaa43 |
fix(auth): refresh an expired Codex token before the quota-restored probe
_probe_codex_quota_restored was called with the exhausted pool entry's stored access token. Exhausted entries are skipped by the proactive refresh chain, so for any cooldown longer than the access-token lifetime (the weekly-cap case the probe exists for) that token has expired: the usage endpoint answers 401 token_expired, the probe maps it to None, and the cooldown is kept. A mid-cooldown credit top-up or plan upgrade was therefore never discovered until last_error_reset_at elapsed, even though the refresh token was still valid (#89415). Add _refresh_expired_codex_probe_token: when the stored token is expired and a refresh token exists, rotate the pair via refresh_codex_oauth_pure (cooldown untouched), persist it (refresh tokens are single-use), and probe with the live token. Both probe callers use it: the pool-only resolve path (_probe_codex_pool_entry_quota_restored) and CredentialPool._codex_quota_restored_upstream. A probe that still reports 100% keeps the bench; the rotated tokens are persisted either way. Fixes #89415 |
||
|
teknium1
|
dc9fec7d60 |
feat(providers): accept chatgpt / chatgpt-codex as names for the openai-codex provider
`--provider chatgpt` (and `chatgpt-codex`) now resolves to the existing ChatGPT-backed Codex OAuth provider in both alias tables (hermes_cli/providers.py::_ALIAS_GROUPS and hermes_cli/auth.py::resolve_provider), so users do not need to know the internal `openai-codex` slug. Storage, transport (codex_responses) and base URL are unchanged; `openai-codex` stays canonical. Fixes #95794 Co-authored-by: DarRahman <darrahman@users.noreply.github.com> |
||
|
teknium1
|
d43c9622f3 |
fix(auth): status and doctor Codex reads never adopt, refresh or persist credentials
`hermes status` / `hermes doctor` / the dashboard cards and the `/model` picker
call `get_codex_auth_status()`, whose singleton fallback ran
`resolve_codex_runtime_credentials()` with runtime defaults: a store missing
its refresh_token imported the Codex CLI's single-use token family, and an
expiring token was refreshed and written back. A diagnostic that spends or
borrows a rotating refresh token logs the other program out (#68004).
`resolve_codex_runtime_credentials(read_only=True)` reports the stored state
as-is (no CLI adoption, no refresh, no pool forced refresh, no write) and wins
over `force_refresh`; the Codex status snapshot uses it, and the xAI OAuth
snapshot passes `refresh_if_expiring=False` for the same reason. The pool side
was already an observation (`peek`,
|
||
|
teknium1
|
89c6a8a145 |
fix(auth): Nous "not logged in" refresh failures leave rotation instead of a silent hour-long bench
A Nous pool entry whose refresh reached the resolver's state-shape raises
("Hermes is not logged into Nous Portal.", "No access token found ...",
"No refresh token is available ...") carried relogin_required=True but no
OAuth code, so `OAuthProviderFlow.is_terminal_refresh_error` classified it
transient: `_recover_failed_refresh` benched the only credential for an
hour with null last_error_* fields and nothing at WARNING (#113718).
Give those raises codes (`nous_auth_missing`, `nous_auth_missing_access_token`,
`nous_auth_missing_refresh_token`) and list them in the Nous flow's
terminal_refresh_codes, mirroring the Codex/xAI `*_auth_missing_refresh_token`
convention. The pool then quarantines, marks the row DEAD with the reason,
and logs the existing WARNING naming `hermes auth add nous`; every consumer
of the classifier (pool, singleton `_refresh_nous_or_quarantine`) agrees.
A failure that says nothing about the login (network error, non-JSON 5xx
body) still benches as before.
Fixes #113718
Salvages #113726 (@whyyagswhy) — tests kept, consumer-side hunk replaced
by the classifier fix.
Co-authored-by: ahrazzle <ahrazzle@users.noreply.github.com>
|
||
|
teknium1
|
69deb43372 |
fix(auth): Codex credential and relogin copy name the failing profile's own sign-in
The three missing-token messages, the refresh_token_reused copy and the
relogin suffix format_auth_error appends all said a bare `hermes auth` /
`hermes model`, which from a named profile re-signs the ROOT store
(
|
||
|
kshitijk4poor
|
debfc7420b |
refactor(providers): finish the keyless cleanup
`get_api_key_provider_status` pre-populated configured/logged_in/base_url/ key_source purely so the deleted keyless short-circuit could return them; every one is now recomputed before the return, so build the snapshot once instead of overwriting four dead placeholders. Same keys, same order, same values. The `_OPENCODE_FREE_EXCLUDED_MODELS` comment also still implied an anonymous path that no longer exists; it now names the two ids it holds and why. |
||
|
kshitijk4poor
|
b388a48a2e |
refactor(providers): drop the now-dead keyless provider plumbing
The keyless OpenCode free tier was the only provider that ever set `HermesOverlay.keyless`, so the flag and everything keyed off it is now unreachable: the `keyless=` field on `HermesOverlay` and `ProviderDescriptor`, the `_overlay_has_creds` early return, both `_provider_is_keyless` copies (auth.py and inventory.py), the `get_api_key_provider_status` keyless short-circuit and its `key_source: "keyless"` placeholder, and the empty `_KEYLESS_STABLE_CACHE_PROVIDERS` set whose `_credential_fingerprint` branch could never match. Dropping the two catalog-derived test exemptions follows: they computed the empty set. |
||
Ritesh Patel
|
998f614c7f |
feat(providers): remove the keyless opencode-free tier
OpenCode's free tier now returns HTTP 403 for anonymous traffic outside the OpenCode client, so the built-in keyless provider is dead weight: - drop the opencode-free provider row, aliases (free/opencode_free), model catalog, keyless runtime ladder rung, header wiring, and cached slugs - delete the model-providers/opencode-free plugin - update tests and the compat manifest for the removed symbols - keep a migration hint in auth.py so users who had it configured see a clear error naming the removal Existing opencode-free configs can move to opencode-zen (pay-as-you-go) or opencode-go (flat subscription). |
||
|
teknium1
|
6de6e6da99 |
fix(anthropic): model-scoped 429 cooldowns live in a pool sibling; restore path no longer NameErrors
Follow-up to the salvaged #111787 commit (@KoNit-K), same mechanism as #75578 (@adikpb). What: - Move the per-model cooldown logic out of the 2.7k-line credential_pool.py facade into agent/credential_pool_model_cooldowns.py (mixin + module helpers), keeping only the select/has_available/next_available_at hooks and the mark_exhausted_and_rotate branch in the facade. - The model cooldown uses the same TTL policy as a credential-wide 429 (_exhausted_ttl: provider reset_at wins, a sole credential keeps its 60s bench) instead of a flat 1h, so a single-credential user is never benched LONGER for the failed model than before. - Drop the `quota_scope == "account"` check: nothing in the tree produces that key. - Also keep billing_unverified 429s credential-wide, matching the credential-wide branch. - _rebind_primary_credential_pool read `rt` that was not in its scope (NameError on every post-fallback restore); pass primary_model from the caller instead. - resolve_anthropic_token(model=...) gates only model-aware callers; model-less diagnostics (usage display, model discovery) keep the key as before. - _anthropic_token_or_raise names the cooled model instead of claiming no credentials exist. - Simplify the salvaged call sites (unconditional select(model=)/resolve_anthropic_token(model=)), widen test stubs that lacked the new kwargs, trim the tests to two invariants on a real temp store. - Docs: credential-pools.md documents per-model Anthropic 429 cooldowns. Why: a generic Anthropic 429 is a per-model rate limit; benching the whole credential took every other Claude model offline while the env/borrowed token path handed the same benched key straight back (#111769, #61451). Co-authored-by: KoNit-K <124019182+KoNit-K@users.noreply.github.com> Co-authored-by: adikpb <67222969+adikpb@users.noreply.github.com> |
||
KoNit-K
|
fb358d4379 | fix(agent): scope Anthropic 429 cooldowns to model | ||
|
teknium1
|
93889b770d |
fix(auth): named profiles no longer inherit the root profile's auth.json (#111724)
A named profile with no credentials of its own silently resolved the root
profile's provider state and credential pool, and a token refresh inside
that profile (xAI, Codex, Anthropic PKCE, Nous) wrote the rotated chain back
into the root store. An isolated service profile therefore acted, and
rotated tokens, as the owner with no way to switch it off.
Maintainer ruling: profiles without credentials are asked to set a provider,
never handed another profile's auth. Profiles are independent islands.
What changes
- `hermes_cli/auth.py`: `_load_provider_state*`, `read_credential_pool` and
`_provider_state_transaction` read the active store only; the global-root
resolver, its mtime memo and `_persist_provider_state_to_store` are gone.
- xAI / Codex / Nous-guest / pool refresh paths persist to the active store;
the root write-through, the borrowed-row bookkeeping
(`_borrowed_root_ids`, `persist_pool_entries`, `_update_root_pool_rows`)
and the forked-grant heal are removed. `_write_hermes_oauth_credentials`
loses its root `target`.
- `resolve_provider` / `agent_init` name the profile in the
no-provider error and print `hermes -p <name> model` guidance.
- `hermes update` prints a one-time notice listing every named profile that
has no provider of its own (`hermes_cli/profile_credential_audit.py`) so a
bot never goes quiet unannounced.
- Desktop create dialog: the "Share keys & accounts" checkbox described the
removed inheritance; it now mirrors API keys (`mirror_credentials`) and
says OAuth logins need a sign-in. `share_auth` is accepted from older
clients and ignored; `ProfileMirrored.auth` is a bool again.
- Docs: profiles.md, multi-profile-gateways.md isolation table,
hermes_cli/AGENTS.md.
The fallback was added in
|
||
Sora-bluesky
|
9085ef967c |
fix(profiles): sweep the remaining pre-write mkdirs under the deleted-profile guard
A long-lived serve process keeps a deleted profile as the context home of threads that outlive the delete. A bare `mkdir(parents=True)` right before an atomic write brings `profiles/<name>/` back after `hermes profile delete` has written the tombstone and removed the tree. The writers in `utils` and the seven callers named in #112592 are guarded by the preceding commits; this one applies the same `mkdir_under_hermes_home` idiom to the other pre-write directory creations found by the same mechanical rule (auth, personality, plugin catalog, skills sync, tool discovery cache, platform adapters, memory plugins, local runtime supervisor, process identity, breadcrumbs). The two sites that pass `mode=` keep their mkdir behind `assert_named_profile_home_live`. The guard is a no-op unless the target has a provable `profiles/<name>` ancestor. Salvaged from #112596 (30-file sweep) on top of #112594 / #112601; the overlapping files were resolved to the already-landed versions. |
||
|
teknium1
|
a1e7f74e64 |
fix: stat signatures cover inode + ctime everywhere config identity is cached
The cherry-picked commit extends the config/profile/MCP/managed-scope/completer/ OAuth/skills-manifest signatures. This commit finishes the class and trims it: - `file_signature()` lives in `utils.py` next to the other stat/metadata helpers instead of `hermes_cli.managed_scope` (gateway/ and agent/ callers no longer reach into the managed-scope module for a generic stat helper). - `hermes_cli/config_effective.py` was left comparing 2-/4-wide prefixes against the widened `_RAW_CONFIG_CACHE` / `_load_config_cache_sig` records, so `load_user_config_effective()` re-parsed on every call (3 parses for 3 calls on an unchanged file, 1 before); index by the new widths. - Sibling caches keyed on the same (mtime, size) shape and reading the SAME files now use the helper: `load_env()` memo, `agent/skill_utils` raw-config and external-dirs caches, `hermes_cli/model_switch` alias identity, `agent/moa_loop` preset stamp, `hermes_cli/auth` global auth-store memo. - Tests trimmed to one invariant each (pinned-mtime replacement invalidates; an unchanged file still hits), both red on origin/main. Left alone on purpose: `tools/registry.py`, `tools/skills_tool_dedup.py`, `gateway/status.py`, `hermes_cli/banner.py`, `hermes_cli/main.py`, `hermes_cli/session_recovery.py` — those fingerprint source files, PID/lock files or write to persisted on-disk caches shared across processes, where an inode/ctime key would churn on every checkout/copy rather than catch a replaced config. |
||
|
teknium1
|
23036e20a6 |
fix(ux): plain-language, actionable user-facing messages (core)
Squashed integration of the user-facing message audit for this surface set. Full per-finding receipts: /tmp/ux-audit/lanes/*-receipt.md (campaign artifacts). |
||
|
kshitijk4poor
|
ca6b189a7c |
fix(codex): both transaction locks wait out the endpoint; adopt only a complete pair
Review follow-ups on the refresh transaction: - `_provider_state_transaction` takes a `timeout_seconds` applied to BOTH the active and the root lock. The refresh passes max(default, refresh timeout + 5 s); before, only the profile lock used that budget and root's lock kept the 15 s default, so the waiting profile raised TimeoutError instead of adopting whenever the peer's POST ran long. The regression test now holds the endpoint past the lock floor and fails without the passthrough. - Peer adoption requires a stored access token as well as a rotated refresh token; an incomplete stored pair falls through to the refresh. - `_save_codex_tokens` keeps its body: the per-path lock is reentrant, so the refresh calls it inside the open transaction (as the CLI-recovery path already did) instead of a split-out helper. |
||
|
teknium1
|
271515b18c |
fix(auth): a configured custom endpoint counts as a provider in auto resolution (#108383)
`resolve_provider("auto")` only honoured `model.provider` when it named a
registry provider, so `provider: custom` (llama.cpp / vLLM / ollama, or a
loopback `base_url` alone) fell straight through to "No inference provider
configured". The boot inventory in free_tier_bootstrap asks exactly that
question, records provider_configured=False, and every `setup.status` in
`hermes serve` answers from that record — the dashboard's Ink chat then
parked each new session on "Setup Required" while `hermes chat` (which
builds the runtime through resolve_runtime_provider) worked on the same
config. Merged in v0.21.2 (#107697
|
||
|
teknium1
|
2be8e6147a |
refactor(secrets): every private-credential file is written by utils.atomic_json_write(mode=0o600)
Ten hand-rolled "write a token file safely" routines each carried a
different subset of {0600-on-create, fsync, atomic_replace, parent-0700
guard, BaseException cleanup}. Two of them (iron_proxy state files,
the exchanged-JWT store) still opened the temp file at process umask
and chmod'ed afterwards - the exact TOCTOU window the others document
as fixed. None of the bare-os.replace copies got atomic_replace's
Windows-contention retry or EXDEV fallback.
utils gains fsync_dir= (absorbs auth.py's dir fsync), atomic_write_bytes
(vault blob) and mode= on atomic_write_text; the ten sites become 1-3
line callers. mkstemp creates the temp file O_EXCL at 0600 regardless of
umask, so the payload is never umask-readable.
Behavior change: iron_proxy proxy.yaml/mappings.json and the exchanged-JWT
store are now 0600 from creation and fsync'd; every credential write goes
through atomic_replace (symlink-preserving, Windows retry, EXDEV copy).
auth_nous shared store now uses atomic_replace too (it forced os.replace
with no recorded reason). secret_sources cache parent-0700 goes through
the guarded secure_parent_dir instead of an unguarded chmod.
|
||
nyx573
|
0007a4c2f9 |
feat(auth): OpenRouter OAuth PKCE login via hermes auth add openrouter --type oauth
Browser login against openrouter.ai/auth (S256 PKCE, bind-first OS-assigned loopback port, POST /api/v1/auth/keys code exchange) that stores the minted key as a plain api_key pool entry with source manual:openrouter_pkce, so it rotates and resolves exactly like a pasted key. Salvaged from #102639 (nyx573) onto the facade+siblings layout: the flow lives in the new auth_openrouter sibling and rides the shared loopback helpers instead of appending to the auth.py facade; auth_commands gains a table row rather than a provider branch. OpenRouter echoes no `state`, so the CSRF nonce rides in the callback path (a redirect that guesses the port but not the nonce is a 404 and never reaches the exchange); remote/SSH sessions use OpenRouter's documented headless paste-the-code mode instead of an unreachable loopback listener. OpenRouter keeps its API-key default when --type is omitted so the documented `--api-key` form is unchanged. |
||
|
kshitij
|
683afe45ba |
fix(auth): a global-root write-through invalidates the root store memo
_load_global_auth_store is memoised on (path, st_mtime_ns). A write-through to the root (borrowed Codex cooldown clear, xAI/Anthropic root rotation) followed by a fallback read in the same mtime tick — coarse-mtime filesystems (exFAT, some network/overlay mounts) — kept serving the pre-write store, so the resolve path could log "quota restored" and then raise quota_exhausted from the stale memo. _save_auth_store(target_path=...) now drops the memo. |
||
|
Teknium
|
0dcadf6f41 |
revert: remove Collective Wisdom V1 (#94266)
Reverts the in-tree org skill-marketplace: hermes_wisdom package, three model tools, CLI/gateway/desktop/dashboard/Telegram/Slack surfaces. Later non-Wisdom work on shared files (guest onboarding i18n, dashboard startup schema, Slack adapter, tui_gateway) is kept; Wisdom-only call sites and config were stripped from those files. |
||
shannonsands
|
a6ee31f55a |
feat(wisdom): add Hermes Collective Wisdom Agent V1 (#94266)
* feat(wisdom): add trusted publish and install foundation
* feat(wisdom): add private contribution loop
* feat(wisdom): add managed consumption workflows
* fix(wisdom): close cross-repository safety gaps
* fix(wisdom): align local package and lifecycle policy
* fix(wisdom): require explicit profile setup
* docs(wisdom): repin reconciled gateway head
* fix(wisdom): fence content downloads and approval receipts
* docs(wisdom): record generation-fenced downloads
* docs(wisdom): record unified delivery PR
* fix(ci): stop passing invalid classifier inputs
* docs(wisdom): remove internal requirements ledger
* feat(wisdom): localize dashboard and desktop copy
* feat(wisdom): complete local contribution and consumption UX
* style(wisdom): satisfy desktop lint
* chore(wisdom): refresh requirements pin
* test(dashboard): allow formatted profile copy
* test(wisdom): stabilize desktop interaction coverage
* fix(wisdom): surface dashboard action failures
* fix(wisdom): add repeatable Portal demo login
* feat(wisdom): add actionable skill notifications
* feat(wisdom): add notification install and update actions
* fix(wisdom): make Telegram skill alerts actionable
* fix(wisdom): always refresh demo Agent login
* feat(wisdom): embed Telegram notification actions
* fix(wisdom): preserve Telegram notifications after actions
* fix(wisdom): keep Telegram notification cards readable
* feat(wisdom): add Telegram candidate approval flow
* feat(wisdom): explain Telegram qualification reasons
* fix(wisdom): reconcile cross-surface candidate actions
* feat(telegram): add Collective Wisdom management command
* chore(wisdom): refresh Gateway contract pin
* chore(wisdom): advance Gateway contract pin
* feat(wisdom): align command UX across clients
* feat(slack): add Collective Wisdom management parity
* feat(wisdom): add security and professionalism reviews
* feat(wisdom): add first-time qualification guidance
* feat(wisdom): simplify qualification sharing choices
* feat(skills): add optional editorial metadata
* feat(wisdom): enrich legacy skill presentation
* fix(wisdom): harden review and update boundaries
* fix(wisdom): emit canonical review timestamps
* fix(wisdom): align with merged gateway and main
* wisdom: add agent-led sharing core (policy, evidence, schemas, templates, delivery, weekly job, share/install flows)
- hermes_wisdom/agent_led/: policy resolution (server > local > defaults),
7-day evidence builder that excludes bundled/hub/managed skills and
dismissed/handled/recently-suggested content hashes, strict pydantic
schemas for agent output with repair-or-reject, fixed copy templates
(Share / Teammate / Published / Update / Mute), idempotent retried
delivery ledger with stale-action resolution, weekly review job,
resumable Share and Install flows.
- prompts/: candidate review, recipient recommendation, share packaging.
- tests/wisdom/test_agent_led.py: 30 tests.
* wisdom: agent-led renderers and button action dispatcher
- render.py: Telegram HTML, Slack blocks, Desktop payload; editorial name
is the emphasized line, product label stays separate.
- actions.py: resolve opaque wa:<action>:<dedup> targets via the delivery
ledger; Not now -> dismissal, Mute -> fixed options, Share -> resumable
packaging flow, Install/Update -> plan command. Never publishes/installs.
* wisdom: CLI verbs, agent_led config default, conversational catalog skill
- hermes wisdom browse/review-week/act/share/dismiss/mute (all --json).
- wisdom.agent_led config block, default enabled.
- SKILL.md rewritten so natural-language catalog questions map to the CLI
verbs, share/install flows and fixed notification templates.
* wisdom: wire agent-led weekly review into gateway tick and Telegram buttons
- gateway housekeeping tick calls maybe_run_weekly_review with a home
channel sender when a Telegram adapter is available.
- Telegram: wa: callbacks resolved through the ledger (stale-safe), mute
duration keyboard, send_wisdom_agent_recommendation rich card + fallback.
* fix(wisdom): integrate local mediation and harden model and setup boundaries
* fix(wisdom): honor authoritative recommendation policy and defer on failure
* fix(wisdom): synchronize opaque suppression and recheck delivery preferences
* feat(wisdom): route weekly selection through the session-owned assessment queue
* fix(wisdom): prepare and submit the reviewed generated share package
* feat(wisdom): separate native Share preparation from publication consent
* feat(wisdom): sync native mute choices through a leased preference outbox
* feat(wisdom): bind native mute controls to durable preference choices
* feat(wisdom): add scoped desktop and dashboard notification settings
* fix(wisdom): revalidate feed recommendations before assessment and delivery
* fix(wisdom): persist validated delivery receipts before completing notices
* feat(wisdom): add private notification claim and receipt client
* Persist Wisdom send reservations and recover delivery acknowledgements
* Route legacy Wisdom controls through current native review
* Add typed private Wisdom operation outcome client
* fix(wisdom): make agent-led advice usable in the local demo
* fix(wisdom): keep requested consent outside proactive limits
* fix(wisdom): distinguish unavailable assessments and preserve digest text
* fix(wisdom): assess ongoing usefulness beyond the current task
* fix(wisdom): restore immediate qualification sharing controls
* fix(wisdom): separate qualification review from installation advice
* fix(wisdom): collapse review checklists and simplify sharing copy
* fix(wisdom): show compact sharing progress and publication receipts
* fix(wisdom): require credential prefixes rather than matching skill names
* fix(wisdom): finish package checks before presenting sharing consent
* fix(wisdom): scan local skills before qualification cards
* fix(wisdom): update moderation results on existing sharing cards
* fix(wisdom): keep sharing review accessible from receipt cards
* fix(wisdom): align mediated review cards and collapsible checks
* fix(wisdom): clarify clean security summary wording
* fix(wisdom): normalize consent plans and add explicit recheck
* fix(wisdom): keep install and update receipts concise
* fix(wisdom): collapse assessments and deduplicate operation cards
* fix(wisdom): restore private Portal review from native cards
* fix(wisdom): sync Portal publication to original consent card
* fix(wisdom): show local skill version on sharing cards
* fix(wisdom): skip agent recommendations for self-published versions
* fix(wisdom): simplify candidate notices and local-edit recovery copy
* feat(wisdom): submit locally reviewed packages with one confirmation
* feat(wisdom): expose safe receipt and outcome sync recovery
* wisdom: onboarding notice says detect and share, names the user's own skill
Copy review from the product owner on the first and returning
qualification notices (fixed delivery mode):
- the feature blurb now says the org enabled detection *and sharing*
- both notices say the detected skill is one the user created
- both close with an exclamation mark
Applied identically to hermes_wisdom.notice, the desktop and web i18n
strings, and the tests that assert the sentences.
* wisdom: one opener, no approval line, ask to share after the skill is shown
Product owner review of the candidate card.
- The Hermes written card now opens with the same sentence as the fixed card
("Your organisation has enabled Collective Wisdom, a feature designed to
automatically detect and share useful skills across all team members.")
instead of its own blurb, so there is one first time message.
- "Nothing is shared without your approval." removed from Telegram, Slack
and Desktop. The buttons already make the permission explicit.
- "Would you like to share?" no longer appears before the skill is named.
It is now the last line, after the skill name, description, why suggested
and the checks, and reads "Would you like to share it?" (matching the
agent led template wording).
Tests updated for the new order; proposalNotice removed from all desktop locales.
* wisdom: American spelling, organization
Product owner decision: user facing copy uses American spelling.
Changes "Your organisation" to "Your organization" in the chat notice,
the Hermes written card opener, the desktop and web strings, and the
tests that assert them. Identifiers such as nas_organisation:* and the
German and French locales are untouched.
* wisdom: candidate card copy round 4 (owner review)
Apply the product owner's round 4 copy decisions to the Hermes Collective
Wisdom candidate card on Telegram, Slack, Desktop and the shared views:
1. Hermes-written cards are titled "Hermes Collective Wisdom" instead of
the bare "Collective Wisdom".
2. The "Reusable skill ready to review" line is gone from the candidate
card (Telegram rich card and plain fallback, legacy agent-led share
template).
3. The skill name and description are labelled: "Skill name: <name>" and
"What it does: <description>" (Telegram, Slack, Desktop).
4. "Why suggested:" is now "Why others might benefit:".
5. A passing professionalism review reads "Safe to share at work ✓ (no
inappropriate content found)" with no per-check bullets and no "Pass";
a failed review reads "Needs a look before sharing at work (possible
inappropriate content)" and lists only the checks that flagged
something. Pending/unavailable wording is unchanged.
6. Telegram button toasts: "Will ask later...", "Preparing more
details...", "Sharing...".
7. Qualification reasons: "You used this skill consistently across many
days." and "You've really refined this skill."
8. prompts/wisdom_candidate_review.md asks for a compelling
editorial_name, a simple one_line_description and a compelling
why_coworkers_benefit under 300 characters; "Be concise and
convincing." becomes "Be concise and compelling: the goal is that the
user wants to share it."
Tests updated for the new strings; review_text() gains direct coverage.
* wisdom: re-apply owner copy after rebase
- Native share cards (advice_view/interaction_view): drop the approval line, ask "Would you like to share it?" as the last line after the checks
- Hermes-written completion card titled "Hermes Collective Wisdom"
- Qualification reasons use the owner wording (consistently across many days / really refined)
- American spelling (organization) in remaining English copy
- Desktop test asserts the current Share button; web test matches the returning notice
* fix(wisdom): pin reconciled Gateway and verify Unicode hash vectors
Pin Gateway 60cd2d6b613ae3cd4a6e65155d1142006d907e78 and byte-identical producer artifacts. Verify every content-order case and package-manifest binding. Validation: 186 focused Python tests, Ruff and contract verifier.
* fix(wisdom): reconcile optional SDK tests and frontend lint
* fix(wisdom): default to agent-written notification summaries
* fix(wisdom): restore deferred install review and browse controls
* feat(wisdom): inspect installed setup with exact package provenance
* feat(wisdom): run native-approved installed setup steps with durable evidence
* fix(wisdom): recover interrupted setup with explicit native consent
* feat(wisdom): hand native installs into guided setup review
* fix(wisdom): continue requested setup with fixed notification copy
* fix(wisdom): preserve setup while waiting for a session model
* fix(wisdom): expose canonical setup review controls on desktop
* fix(wisdom): resume setup after recorded automatic updates
* fix(wisdom): make missing setup prerequisites recheckable
* chore(wisdom): align Agent with verified Gateway contract
* fix(wisdom): stop guessing team slugs in portal links
* fix(wisdom): retire pending advice on account sign-out
* fix(wisdom): cancel advice after terminal account revocation
* fix(wisdom): fence feed responses across account sign-out
* fix(wisdom): checkpoint signed-out feed before reactivation
* fix(wisdom): link proactive advice to scoped notification settings
* fix(wisdom): coalesce queued publication recommendations by version
* fix(wisdom): keep package review navigation local and deferable
* fix(wisdom): reflect installed state in discovery controls
* fix(wisdom): show exact checks before command confirmation
* chore(wisdom): pin bounded analytics privacy contract
* chore(wisdom): pin retired legacy notification contract
* feat(wisdom): review publisher usage with exact sharing copy
* fix(wisdom): align discovery and review check summaries
* fix(wisdom): show expired consent before confirmation
* fix(wisdom): require fresh review for legacy install controls
* fix(wisdom): preserve review expiry across check toggles
* fix(wisdom): retain update policy in native install reviews
* fix(wisdom): surface failed native card edits
* fix(wisdom): persist local command approval reviews
* fix(wisdom): use saved approvals for messaging commands
* test(wisdom): provide scan result in setup handoff fixture
* test(wisdom): exercise Telegram approvals with saved review state
* fix(wisdom): retain suppression policy for offline deferral
* fix(wisdom): reconsider candidates after deferred suppression expires
* fix(wisdom): bind review checks and report verified readiness separately
* fix(wisdom): persist accepted publication intent and recover exact outcomes
* fix(sync): pin UTF-8 tree ordering across writers
* chore(wisdom): pin organisation-scoped Gateway authorization
* fix(wisdom): restrict consent delivery to user-facing sessions
* chore(wisdom): refresh reviewed Gateway contract pin
* fix(wisdom): preserve kept tools in Blank Slate exclusions
* test(auth): reset anonymous fixture with a profile-scoped cache
* fix(wisdom): gate local surfaces and work on current profile entitlement
* fix(wisdom): invalidate quiet tool cache on entitlement changes
* test(wisdom): authorize local consent gateway fixtures
* fix(wisdom): keep entitlement decoding free of native crypto imports
* test(wisdom): provide local entitlement to demo CLI subprocess
* ci: leave upstream workflow unchanged in Wisdom PR
* fix(wisdom): ship package and contracts in Nix wheels
---------
Co-authored-by: hbizi <36184542+hbizi@users.noreply.github.com>
|
||
pierrenode
|
173105ce6f |
fix(auth): scope the resolve_nous_access_token memo to the active profile
resolve_nous_access_token()'s 5s startup-burst memo (#76930) cached the resolved Nous Portal access token in a single module-level slot keyed by nothing but wall-clock time. The underlying resolution is profile-scoped: _auth_file_path() reads get_hermes_home(), which checks the context-local _HERMES_HOME_OVERRIDE ContextVar before falling back to the HERMES_HOME env var — gateway/run.py and tui_gateway/server.py set that override per-profile for multiplex concurrency. In a multiplex gateway serving two profiles with different authenticated Nous accounts, if profile A's context resolves a token and profile B's context calls resolve_nous_access_token() within the next 5 seconds, profile B received profile A's cached token — used to authenticate against the managed tool gateway / relay self-provisioning under the wrong account. Key the memo by str(get_hermes_home()) instead of a single slot, so each profile's context reads only its own cached token. The lock around read/write is unchanged; only the cache's shape moved from a single (timestamp, token) tuple to a dict keyed by resolved home. (cherry picked from commit 9d8846b88cfd2ea74c6958d5f8f28a50880dda75) |
||
Siddharth Balyan
|
4bdd64b334 |
The free tier is created in one place, at boot, only behind HERMES_GUEST_ONBOARDING=1 (NS-847) (#107697)
* fix(auth): close the free tier's gaps against the gateway's welcome-tier contract The inference gateway's welcome tier (NousResearch/api DOCS/anon-tier/plan.md) serves an anonymous account exactly one model on its own host, refuses everything else with a structured 429, cross-refuses a request on the wrong host with a 400 (403 while the tier is dark), and tells a signed-in account that still asks for `nous/welcome` what to switch to in an `x-nous-model-switch` header. Four client-side gaps against that contract: - Auxiliary calls were refused on every session. The auxiliary client asked the welcome host for the Portal's recommended compaction/vision model, a guaranteed 429 `model_not_free` before each fallback. On the welcome host it now uses `nous/welcome` (its backing model covers auxiliary work) and skips Nous for vision, which the welcome model does not take. - The structured 429 body was never read. The classifier now parses `reason` / `retry_after` / `alternates` / `upgrade_url`: `model_not_free` and `feature_not_free` are non-retryable gates that fall back; `at_capacity`, `admission_closed` and `rate_limited` are rate limits that honour `retry_after` and never rotate the free tier's only credential. The wrong-host 400 and the dark-tier 403 are deterministic, so they abort this route and fall back instead of retrying or re-exchanging. The terminal paths say what happened and name the sign-in (`/login` in a chat, `hermes auth upgrade` in a terminal). - The `x-nous-model-switch` header was ignored. The chat-completions transport records it beside the rate-limit and credits headers; the next call moves the session, and the config default when it still names `nous/welcome`, to the backing model the gateway named. - A guest fell back to the paid host. With `inference_base_url` absent from the exchange or outside the host allowlist, routing defaulted to inference-api, where every request is a 400. A guest now defaults to the welcome literal at the exchange, in the shared store's shape, and in effective routing. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> (cherry picked from commit fc758aad7efceff6223fc144a9b5c69f13e41bd8) * feat(auth): the free tier is set up on request; nous.guest_setup decides whether also on first use A caller that names nous/welcome on a Nous route with no Nous identity in reach — the guided setup's session (provider=nous, which skips the resolver's nothing-configured rung), the free-tier picker row, a bare --provider nous pointed at it — is asking for the free tier. The OAuth runtime rung now sets it up there instead of failing "not logged in", so the guided chat no longer races the root profile's first-run mint. nous.guest_setup is the policy seam: "auto" (default) keeps today's first-use setup wherever nothing else is configured; "on-request" mints only when the free tier is asked for by name (nous/welcome, /login, hermes auth upgrade, replacing a retired identity). Implicit callers — the resolver's last rung, the first-run check, free_tier.status, the CLI's background setup, the connector token path — still adopt what the shared store holds, so every profile follows the one identity the guided setup created, but never create one on their own. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> (cherry picked from commit ae915ddc65ecdb81b81e29b604671d15cd49233c) (cherry picked from commit 62ad1ff3ab200ea064975a32c502041b25910165) * feat(auth): the guided setup provisions the free tier explicitly; nous.guest_setup is auto | explicit Two questions govern the free tier: may it exist (nous.guest) and who may CREATE the identity (nous.guest_setup). "auto" (default) keeps today's first-use setup wherever nothing else is configured. "explicit" means Hermes never creates one on its own: the only creator is the new provision_free_tier() primitive, exposed as the free_tier.provision RPC, which the guided setup on Hermes Desktop calls as its first step — on the root gateway, before the setup profile and before the guided chat exists — so the identity lands in the root store every profile reads through and is there before any session asks for nous/welcome. That closes the race against the backend's own setup, and makes "only when the setup-bot flow is used" literally true. The earlier "on-request" tier is replaced: it minted whenever any caller named nous/welcome (the hermes model row, --provider nous), which treated a model name as intent and was broader than the guided setup. Under "explicit" a nous/welcome request with no identity fails "not logged in" as before the free tier existed, and /login or hermes auth upgrade report nothing to sign in from. Implicit callers still adopt an identity the shared store holds, and a retired credential is replaced (a continuation, not a creation). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> (cherry picked from commit c63d2c935c1e59016164fdfb90cf70b4094466a0) * fix(auth): remove the nous.guest_setup knob; the free tier is created on first use `nous.guest_setup: auto | explicit` decided who may CREATE the free-tier identity. Under its default every line it added was inert (`may_mint` always true), nothing in tree set `explicit`, unknown values read as `auto`, and under `explicit` a CLI-only install could never get an identity, which contradicts the first-run contract (first command mints, then chats). The mint race the knob accompanied is already benign: every caller takes the profile lock then the shared-store lock, and the loser adopts what the winner wrote. What makes the guided setup win deterministically is `provision_free_tier()` behind the `free_tier.provision` RPC, which stays. `nous.guest` remains the only free-tier policy. Removed: `guest_setup_policy()` and its constants, the `explicit=` / `may_mint=` threading through `ensure_portal_identity` and `_reconcile_and_provision`, the flag at the three replacement call sites (now no-ops), the config default, the docs section, and the four `guest_setup` test-config entries. The three policy tests that hold regardless of the knob are kept under `TestExplicitProvision`; the two that only tested the knob are deleted. (cherry picked from commit d8a50526d93c374c0067dd935b5a65055e0af261) * fix(gateway): a server-driven model switch off nous/welcome does not evict the cached agent When a signed-in account still asks the paid host for `nous/welcome`, the inference gateway serves the current backing model and names it in `x-nous-model-switch`. `apply_model_switch` moves the live session to that model and moves `config.yaml`'s default off the alias in the same step. The messaging gateway's fallback-eviction check compares the agent's model with the config default and evicts on any mismatch that is not a /model override, so when the config write did not land (unreadable config, lock) the cached agent was evicted once per turn, and prompt caching with it. `apply_model_switch` now stamps the alias it moved the session off on the agent, and `_is_intentional_model_switch` treats "agent moved off the alias the config still carries" as deliberate, beside the existing /model override case. The check takes the agent and the config model instead of a bare model string; its one caller in `_run_agent_evict_on_fallback` passes them. (cherry picked from commit 696d1ec86b69db28bf002c841e9389b85178a954) * fix(auth): the free tier outranks implicit host credentials in provider resolution On a fresh install with a leftover ~/.aws profile, resolve_provider("auto") reached the Bedrock rung before the free-tier rung, so the first turn ran on Bedrock and failed 403 while the free tier was still being minted in the background at agent setup (NS-829). Live on a Mac with ~/.aws present: 28 s, three retries, no answer; the next process then switched to nous/welcome. The free-tier rung now sits directly above the Bedrock chain: when nous.guest is on, an existing free-tier identity answers, else a blocking mint runs, and only then does the boto chain get a say. Everything above is unchanged and still wins: CLI creds, config.yaml model.provider, env keys, the OpenRouter pool, a logged-in active_provider. nous.guest: false skips the rung, and a failed mint still falls through to Bedrock and the no-provider guidance. Tests: six precedence cases (identity present, fresh mint, free tier off, env key still wins, sign-in still wins, failed mint falls through). The opt-out test now neutralizes the AWS chain like the precedence tests do; on a machine with ~/.aws it was failing for the same reason as the bug. Live after the fix, same Mac, AWS credentials visible, isolated shared store: identity minted 2 s in, turn on model=nous/welcome provider=nous, answer in 11 s. (cherry picked from commit a04b05260cd334dd7199ad9b6cd5b2538364c75a) * fix(auth): review follow-ups for the free-tier rung (NS-829) - tests/agent/test_bedrock_integration.py: the Bedrock auto-detect test switches the free tier off; its contract is the boto chain, and the free tier now sits above it. - gateway/run_notifications.py: the free-tier startup line reads auth.json before consulting the resolver, so a gateway boot on a machine with AWS credentials never mints or refreshes over the network. - hermes_cli/anon_auth.py: module docstring says where the free tier sits in the ladder instead of "the ladder is untouched". - tests/hermes_cli/test_provider_precedence.py: two invariant tests instead of six (parametrized ladder cases; a failed mint that returns None or raises falls through to Bedrock). scripts/run_tests.sh on the five affected files: 147 passed, 0 failed. (cherry picked from commit 10790d148c60ada11b9ecdde2cd2c836c6a82a11) * feat(auth): HERMES_GUEST_ONBOARDING=1 is the one launch gate for the free tier; HERMES_FORCE_GUEST is gone The free tier is pre-GA. Until GA it must not exist for anyone who did not ask for it: no identity minted, no portal traffic, no free-tier copy on any surface. One environment variable now decides that, and one function reads it. `guest_enabled()` returns False unless `HERMES_GUEST_ONBOARDING` is exactly "1"; only then does `nous.guest` (the user's off switch) get consulted. Every free-tier site already funnels through `guest_enabled()`, so the gate closes minting, routing, connector entitlement, status lines and the picker row in one place. With the variable unset, `resolve_provider("auto")` on a fresh install raises `no_provider_configured` exactly as upstream does. `HERMES_FORCE_GUEST` and `force_guest_mode()` are removed. They inverted the gate (forced the tier ON over `nous.guest: false`), their "new" value re-minted identities as a side effect of provider resolution, and `_has_any_provider_ configured` read them ahead of every other check, making the CLI a second reader of a flag that must have exactly one. `_forced_new_done` and the `force` parameter of `_reconcile_and_provision` go with them. Supersedes the dev lever introduced in fcf9d11679 (rung 1) and hardened in b5c162c3ec. Ruling: NS-845 Q1.1 (recorded on NS-847). Not a user preference: the variable is never written to config.yaml or .env and never shown in setup. It is deleted at GA together with its comment in anon_auth.py. This is a deliberate, temporary exception to the "no new HERMES_* env vars for non-secret config" rule. Tests: fixtures set the gate instead of deleting the old lever; one new invariant (`test_launch_gate_off_means_no_free_tier_at_all`) proves that "", "0", "true" and "new" all leave the tier off with zero portal calls, red on the previous commit. The `HERMES_FORCE_GUEST=new` re-mint test is deleted with the feature. * feat(auth): the free-tier identity is created in one place, at boot; every other site is a read Before this commit eight sites could create a Nous free-tier identity as a side effect of something else: resolving a provider, the CLI's first-run check, the CLI's session setup (in the background beside an own key), a connector bearer read, the desktop polling `free_tier.status`, the sign-in precondition, the desktop's `free_tier.provision`, and the dead-credential re-mint. A poll could mint. Provider resolution could hit the network. Two of them raced each other on a fresh install. Now `hermes_cli/free_tier_bootstrap.py::run_bootstrap` is the only creator. `hermes serve` runs it on a daemon thread from `_lifespan` beside the other background boots; `cmd_chat` runs it synchronously before the first-run guard. It inventories credentials first (`resolve_provider("auto", skip_free_tier=True)`: what would carry inference if the free tier did not exist), creates the identity only when `guest_enabled()`, resolves inference, records a `SetupRecord` in process memory and broadcasts ONE `setup.ready` event. It runs on every boot; only the mint is gated. `ensure_portal_identity` now requires `explicit=True` and raises otherwise. Its callers are the bootstrap, the desktop's `free_tier.provision` (the explicit retry when the boot could not create the identity) and the two dead-credential replacements (`auth_nous.resolve_nous_runtime_credentials`, `managed_tool_gateway._replace_dead_guest_token`). The background thread path and `provision_free_tier` are deleted with their last callers. Reads that used to mint and now only read: `auth.py::resolve_provider` rung 7 (an existing identity still outranks the Bedrock chain, NS-829 ordering kept), `main.py::_has_any_provider_configured`, `cli_agent_setup_mixin._ensure_runtime_credentials`, `managed_tool_gateway.read_nous_access_token` (no identity -> None), `anon_sign_in.run_sign_in` (no identity -> Unavailable), `methods_free_tier` `free_tier.status`. `setup.status` answers from the record for the launch profile, blocking up to 8 s while the bootstrap is in flight so a client's first poll lands after the identity exists rather than racing it; a named profile, or a process that never ran the bootstrap, keeps today's live probe. The record's fields ride along additively (`ready`, `free_tier`, `other_providers`, `inference_provider`). Identity and inference are decoupled (NS-845 Q1.3): the mint sets `active_provider="nous"` only when the inventory found nothing else usable (`_mint_locked(carries_inference=)`); an adopted account always does. A token refresh no longer re-elects the provider it refreshed (`_save_provider_state_to_source` writes credentials, not the user's choice) — that write was how an own-key install ended up on the free tier after the first connector call. Supersedes the mint sites in fcf9d11679, a42d0748fc (first-run check), bbbaa8935a (CLI background setup), 0179efc989 (`free_tier.status` mint), 62ad1ff3ab / c63d2c935c / d8a50526d9 (the `nous.guest_setup` knob and `provision_free_tier`), and a04b05260c (blocking mint in the resolver). Ruling: NS-845 Q1.2 + Q1.3, recorded on NS-847. Tests: `TestBootstrapIsTheOneCreator` (one mint per process; own key keeps inference; reads never reach the portal; a refused mint is memoised), `free_tier.status` fails loudly if it ever calls the creator, the resolver stub fails loudly if resolution ever mints, `setup.status` reads the record, `skip_free_tier` proves the inventory question. The three sign-in tests for the deleted pre-mint collapse into one (`no identity -> Unavailable, zero portal calls`). Live: real `_lifespan` boot with a fake portal, gate on and off (/tmp/ns847-recon/evidence/e2e-rung5-c2-serve-boot.txt), and the CLI matrix incl. an own-key cell (e2e-rung5-c2-bootstrap.txt), 20/20. * fix(credits): the welcome host is free-tier evidence, so a free-tier identity never sees "run /topup" A free-tier identity carries $0 by design, so the portal seed reports `paid_access=False` for it. `is_free_tier_model` did not know the welcome host, read that as a depleted account, and every free-tier turn ended with the credits-depleted notice telling the user to top up an account they do not have. Rule (4) in `is_free_tier_model`: a `base_url` on the Nous welcome host (`anon_auth.route_is_welcome_host`) is the free tier. The host is the evidence, not the model name: the paid inference host can serve `nous/welcome` to a named account and that account's depletion is real, so `("nous/welcome", <inference host>)` stays False. Local data only, like the three rules above it. Restores the two contracts dropped by hermes-magic 674e11d1eaa (the prototype line ran without unit tests): the welcome host is free without any pricing evidence; the model name alone is not. The first is red without this fix. * fix(copy): free-tier text stops promising a connector transfer and never names the config key Sign-in copy on every surface said "Sign in to keep your connectors" and ended with "Your connectors are kept." The transfer registry that would make that true is empty (NS-821): nothing carries over today. The copy now says what signing in does give ("unlock more models and tools") and the completion line names the account, not a transfer. The docs page loses the "connectors carry over" paragraph for the same reason. The picker's off-state line exposed `nous.guest: false` and the word "guest"; user copy names the free tier only (R-USR-1). The docs page gains the pre-rollout note: until GA nothing on it happens without `HERMES_GUEST_ONBOARDING=1`. Its "first command mints" and "replaced on next use" sentences now describe the boot bootstrap. zh is a strict locale: the `freeTier` block was English placeholder text copied from `en`; it is now Chinese. `connectorsKept` is renamed `completedBody` since it no longer talks about connectors. * feat(desktop): the free-tier launch flag is decided once in Electron and stamped onto every backend spawn The Python backend reads `HERMES_GUEST_ONBOARDING` and treats exactly "1" as on. Until now nothing in the desktop set it, so a packaged app could never turn the free tier on, and a backend spawned by the app could disagree with the app about whether the tier was live. `electron/guest-onboarding.ts` owns the decision: `guestOnboardingEnabled` is true when the launch env has `HERMES_GUEST_ONBOARDING=1` or argv has `--guest-onboarding` (the packaged-app spelling). It is read ONCE at launch into a module constant. `desktopBackendSpawnEnv` wraps every backend env as the outermost call and writes the flag LAST, as "1" or an explicit "0", so no earlier spread (`process.env`, `backend.env`) can resurrect a stray value from the parent shell. Stamped onto all three spawn sites: the primary `serve` spawn, the pooled per-profile spawn, and the remote SSH `exec env ...` command (which gains ` HERMES_GUEST_ONBOARDING=1` only when on). The embedded terminal PTY and the backend probes are not backend spawns and do not get it: a `hermes --tui` typed in the pane must not mint. The renderer learns the same fact read-only through the existing `hermes:launch-flags` sync IPC (`guestOnboarding`) and preload (`window.hermesDesktop.guestOnboardingEnabled`). Ruling: NS-845 Q1.1 / Q2 (env var is the contract, `--guest-onboarding` maps to it in main). Two invariant tests on the pure helpers: only "1" or the argv flag enables; the spawn env carries "1"/"0" as the last word and preserves every other key. * feat(desktop): the renderer learns free-tier readiness from one `setup.ready` push, not a 60 s poll The backend's boot bootstrap now announces `setup.ready` once, after it has created (or refused) the free-tier identity and resolved the inference route. The renderer used to discover both by polling `setup.status`, `setup.runtime_check` and `free_tier.status` every 60 s from `useStatusSnapshot`; a fresh install's chip, notice strip and onboarding overlay could sit stale for up to a minute after boot, and three RPCs a minute per window kept asking a question whose answer changes only at boundaries the backend already announces. `handleLifecycleEvent` routes `setup.ready` (active source only, like `skin.changed`) to `notifySetupReady()`, a one-shot tick atom in `live-sync.ts` beside the other change ticks. `useStatusSnapshot` listens to it and runs one readiness round at once (`setup.status` + `setup.runtime_check` + `free_tier.status`). The readiness legs also run once on open and on return from another app, as today. The 60 s tick keeps only `getStatus()`. `SetupStatusSnapshot` types the record's additive fields (`ready`, `free_tier`, `other_providers`, `inference_provider`); readiness semantics are unchanged and still key on `provider_configured` + `runtime_check`. Ruling: NS-845 Q1.2 (renderer half). Tests: the lifecycle branch fires one refresh from the active source and none from another; the snapshot hook's contract is three legs on open, one leg on the tick. * fix(cli): the banner names the free tier's model instead of "no model configured" The welcome banner prints before credentials resolve, so on a fresh install `model` is empty and the banner said, in red, "no model configured — run /model or hermes setup". Under the free tier that is false: the route is already known from local state (identity on disk, tier on), and the first message will run on `nous/welcome`. `_banner_left_lines` now asks the route the same question when `model` is empty (`guest_carries_inference()`, a local read) and shows `welcome · Nous Research`. When nothing resolves the red line stays. Ruling: NS-845 ("the banner's 'no model configured' line reads the resolved route"). Live: fresh HERMES_HOME + fake portal, gate on -> `welcome · Nous Research`; gate off -> the red line, zero portal calls. * fix(aux): vision on the free tier uses nous/welcome too The text-only modality on the gateway's `nous/welcome` row is DeepSeek V4 Flash's, the backing model until the repoint; `z-ai/glm-5.3-flash` is natively multimodal and the repoint declares the welcome row `text+image->text`. Skipping Nous for vision on the welcome host would have sent every image step past the free tier for no reason, so the auxiliary client pins the route's one model for every lane. A backing model that takes no images answers with the upstream's own error, which the ladder handles as it always has. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> (cherry picked from commit 7456e028faba55480db43015dc2c8df3e393a415) * fix(gateway): hermes gateway run is a boot owner of the free tier too Rung 5 made every demand-time free-tier site a read: resolve_provider, the connector token, the /login precondition. That is only correct if every process that can reach those sites ran the bootstrap first. The CLI (cmd_chat) and hermes serve (_lifespan) did; the standalone messaging gateway did not. A fresh HERMES_HOME with the gate on and `hermes gateway run` reached provider resolution with no identity to consume, and /login returned Unavailable. Reported by @andrexibiza on #107697 (P1). GatewayRunner.start now runs `free_tier_bootstrap.run_bootstrap` on an executor thread right after startup recovery and BEFORE any adapter connects, so a fast first DM cannot arrive with nothing to resolve. It is its own step, not part of the turn-machinery warm-up: the warm-up is an optimisation with an off switch (HERMES_STARTUP_WARMUP_TIMEOUT<=0); the bootstrap is correctness and must always run. With the gate unset it is a local inventory and no network. Live, real GatewayRunner.start against a fake portal in a fresh home: gate on -> 1 create, identity persisted, resolve_runtime_provider=nous, /login precondition sees the identity gate off -> 0 portal calls, no identity, no_provider_configured Before the fix the gate-on row was identical to the gate-off row. Test: the bootstrap seam runs before _start_prefilter_platforms and delegates to the one creator. Red on 5554eb6993 (no seam), green here. --------- Co-authored-by: Robin Fernandes <robin@soal.org> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> |
||
|
Siddharth Balyan
|
04a76c4109 |
fix(auth): a sign-in from the free tier settles the default model and route (#105259)
* fix(auth): a sign-in from the free tier settles the default model and route once, for every caller Picking the free-tier row leaves model.default at nous/welcome pinned to the welcome host. After a sign-in an account cannot keep either: the welcome host refuses account tokens, and the portal host serves nous/welcome as a paid model. One completion step, anon_auth.settle_after_upgrade, now runs after the account is persisted: a config on the free tier's route moves to the account's inference host and the recommended default for the account's plan, through the same config write a plain Nous login uses; a config on the user's own model is left alone. The pick is the one GET /api/model/recommended-default already makes, factored into models.recommended_nous_default_model so the CLI and the desktop land on the same model. hermes auth upgrade prints the new default. * fix(auth): a sign-in completion with no eligible recommendation leaves no default model The static provider-wide default is not narrowed by the account's plan or org policy, so writing it as a fallback could persist a model the account may not use. When the recommendation cannot yield a model, the route still moves to the account's host but model.default is left unset; the CLI says so and points at `hermes model`. * docs(free-tier): say what happens when no recommendation is available after sign-in * fix(auth): sign-in completion moves the host and clears the default in one config write Two writes could fail between them and leave the account host paired with nous/welcome. _update_config_for_provider gains clear_default so the caller with no model to offer removes model.default in the same atomic write that sets the host. |
||
|
Siddharth Balyan
|
a2db110ccc |
feat(auth): Nous free tier: free inference and connectors out of the box, one command to sign in (#105258)
* feat(auth): Nous free tier core: anonymous identity minted on first use, welcome inference, shared-store scoping A fresh install with no provider sets up a free Nous identity (anonymous auth method of the nous provider) instead of forcing the setup wizard. The identity is persisted through the same path a real login uses, so the resolver ladder is unchanged. Two seams differ: token acquisition re-exchanges the anon credential (no refresh token), and routing pins the welcome host's single model nous/welcome. One identity per shared store; nous.guest: false turns the free tier off. * test(auth): free tier core contracts: lifecycle, resolver precedence, exchange seam, model pin * docs(user-guide): free tier and signing in New page explaining what a fresh install gets before any key or sign-in (free inference on nous/welcome plus connectors), how the free tier coexists with a user's own API key, how to sign in with hermes auth upgrade and keep connectors, how to turn the free tier off with nous.guest, what hermes logout does in each state, a troubleshooting table, and a plain privacy note. Wired into the Using Hermes sidebar. * fix(auth): logout leaves the free tier alone and clears the shared store for a real Nous account Logging out of the free tier is a no-op: it is not a login, so nothing is cleared and the user is told they were never signed in. Logging out of a real Nous account now also clears the cross-profile store, so a profile logout is not silently re-adopted on the next boot. * fix(model): switching off the free tier points at signing in, never hops providers * Name the free tier in the gateway startup notice and tell explicit-provider installs about it once * Render the Nous free tier as free tier on auth status, auth list, hermes status and portal info, short-circuit billing copy for it, and skip the keepalive when there is no refresh token * fix(auth): free tier is set up where nothing is configured: resolver last rung and first-run check Both the provider resolver's terminal rung and the CLI first-run check now try to set up the free tier before declaring nothing configured. On a fresh install the first command lands in chat on nous/welcome; a failed setup still falls through to the existing guidance. * Add hermes auth upgrade: sign the free tier into a Nous account while keeping its connectors The device-code flow runs as usual, with a promotion intent registered on the portal between the code request and the token poll so the account that approves the code inherits the free tier's connectors. The promotion status decides the outcome: only a completed one is followed by the token grant, which is persisted over the free-tier singleton and the shared store. Declined, superseded, retired and busy outcomes each print their own plain copy, and a retired identity is cleared so the next use sets up a fresh one. User-facing text never names the free tier's internals. * Show the Nous free tier as one picker row with nous/welcome and hide it when nous.guest is off * fix(auth): upgrade opens the consent page for this sign-in; one mint attempt per process; forced free tier wins the first-run check The browser leg of hermes auth upgrade now prints and opens the promotion claim URL with the claim code, not the generic device page. A failed mint is attempted once per process so several bootstrap sites cannot hit a closed gate or a 429 twice; a retired credential resets that so re-minting still happens. HERMES_FORCE_GUEST is honoured ahead of the first-run provider check. * fix(auth): pin the welcome model on the selected route, not on profile state; background setup retries after a failure A credential-pool entry can select a paid Nous key while the profile singleton is still the free tier. The model pin now keys on the resolved endpoint (welcome host) in agent init and /model, and the pin in model normalization is removed since it had no route to look at. A failed background identity setup releases its latch so a later attempt in the same process can try again. * fix(auth): decide the Nous model together with the route on every credential-pool swap The credential pool can move a Nous agent between the welcome host and the portal host after init. One helper, pin_model_for_route, now runs at init and inside every pool swap, so the welcome host always carries nous/welcome and a paid endpoint always keeps the caller's model. * fix(auth): apply the route model policy on every wire mode during a pool swap; release the setup latch if the thread cannot start * fix(auth): free-tier lifecycle takes profile then shared lock, reconciles with the shared store, persists the mint before exchanging, and clears only the identity that died The shared store is the identity of record for a Hermes root: a profile holding a stale free-tier identity adopts a sibling's newer sign-in instead of keeping the guest, and never overwrites the shared account. Locks are taken in the documented order (profile, then shared). A minted credential is stored as soon as create succeeds, so a rate-limited or timed-out exchange does not lose it and trigger a second mint. Retiring a dead credential removes only that credential from both stores. Guest exchange uses the resolver's canonical portal URL. * fix(auth): a credential rotation never rewrites the conversation model; connectors honour the off switch and replace a retired free-tier credential The welcome host serves one model, so a rotation onto it is refused for any conversation on another model instead of silently switching that conversation to nous/welcome (the model pin applies only when a route is first chosen). The connector token path now treats the free tier as absent when nous.guest is false, including cached tokens, and shares the one dead-credential rule with inference: a retired identity is replaced once rather than returning its stale token. * fix(auth): plain login never imports the free tier as OAuth credentials; the gateway startup line reads persisted state only A free-tier identity in the shared store is not an OAuth credential to offer for import; a real sign-in replaces it. The gateway's startup notice now answers provider precedence from persisted state (no token refresh at boot), so an expired free-tier token cannot stall the online message. |