* feat(auth): Nous free tier core: anonymous identity minted on first use, welcome inference, shared-store scoping A fresh install with no provider sets up a free Nous identity (anonymous auth method of the nous provider) instead of forcing the setup wizard. The identity is persisted through the same path a real login uses, so the resolver ladder is unchanged. Two seams differ: token acquisition re-exchanges the anon credential (no refresh token), and routing pins the welcome host's single model nous/welcome. One identity per shared store; nous.guest: false turns the free tier off. * test(auth): free tier core contracts: lifecycle, resolver precedence, exchange seam, model pin * docs(user-guide): free tier and signing in New page explaining what a fresh install gets before any key or sign-in (free inference on nous/welcome plus connectors), how the free tier coexists with a user's own API key, how to sign in with hermes auth upgrade and keep connectors, how to turn the free tier off with nous.guest, what hermes logout does in each state, a troubleshooting table, and a plain privacy note. Wired into the Using Hermes sidebar. * fix(auth): logout leaves the free tier alone and clears the shared store for a real Nous account Logging out of the free tier is a no-op: it is not a login, so nothing is cleared and the user is told they were never signed in. Logging out of a real Nous account now also clears the cross-profile store, so a profile logout is not silently re-adopted on the next boot. * fix(model): switching off the free tier points at signing in, never hops providers * Name the free tier in the gateway startup notice and tell explicit-provider installs about it once * Render the Nous free tier as free tier on auth status, auth list, hermes status and portal info, short-circuit billing copy for it, and skip the keepalive when there is no refresh token * fix(auth): free tier is set up where nothing is configured: resolver last rung and first-run check Both the provider resolver's terminal rung and the CLI first-run check now try to set up the free tier before declaring nothing configured. On a fresh install the first command lands in chat on nous/welcome; a failed setup still falls through to the existing guidance. * Add hermes auth upgrade: sign the free tier into a Nous account while keeping its connectors The device-code flow runs as usual, with a promotion intent registered on the portal between the code request and the token poll so the account that approves the code inherits the free tier's connectors. The promotion status decides the outcome: only a completed one is followed by the token grant, which is persisted over the free-tier singleton and the shared store. Declined, superseded, retired and busy outcomes each print their own plain copy, and a retired identity is cleared so the next use sets up a fresh one. User-facing text never names the free tier's internals. * Show the Nous free tier as one picker row with nous/welcome and hide it when nous.guest is off * fix(auth): upgrade opens the consent page for this sign-in; one mint attempt per process; forced free tier wins the first-run check The browser leg of hermes auth upgrade now prints and opens the promotion claim URL with the claim code, not the generic device page. A failed mint is attempted once per process so several bootstrap sites cannot hit a closed gate or a 429 twice; a retired credential resets that so re-minting still happens. HERMES_FORCE_GUEST is honoured ahead of the first-run provider check. * fix(auth): pin the welcome model on the selected route, not on profile state; background setup retries after a failure A credential-pool entry can select a paid Nous key while the profile singleton is still the free tier. The model pin now keys on the resolved endpoint (welcome host) in agent init and /model, and the pin in model normalization is removed since it had no route to look at. A failed background identity setup releases its latch so a later attempt in the same process can try again. * fix(auth): decide the Nous model together with the route on every credential-pool swap The credential pool can move a Nous agent between the welcome host and the portal host after init. One helper, pin_model_for_route, now runs at init and inside every pool swap, so the welcome host always carries nous/welcome and a paid endpoint always keeps the caller's model. * fix(auth): apply the route model policy on every wire mode during a pool swap; release the setup latch if the thread cannot start * fix(auth): free-tier lifecycle takes profile then shared lock, reconciles with the shared store, persists the mint before exchanging, and clears only the identity that died The shared store is the identity of record for a Hermes root: a profile holding a stale free-tier identity adopts a sibling's newer sign-in instead of keeping the guest, and never overwrites the shared account. Locks are taken in the documented order (profile, then shared). A minted credential is stored as soon as create succeeds, so a rate-limited or timed-out exchange does not lose it and trigger a second mint. Retiring a dead credential removes only that credential from both stores. Guest exchange uses the resolver's canonical portal URL. * fix(auth): a credential rotation never rewrites the conversation model; connectors honour the off switch and replace a retired free-tier credential The welcome host serves one model, so a rotation onto it is refused for any conversation on another model instead of silently switching that conversation to nous/welcome (the model pin applies only when a route is first chosen). The connector token path now treats the free tier as absent when nous.guest is false, including cached tokens, and shares the one dead-credential rule with inference: a retired identity is replaced once rather than returning its stale token. * fix(auth): plain login never imports the free tier as OAuth credentials; the gateway startup line reads persisted state only A free-tier identity in the shared store is not an OAuth credential to offer for import; a real sign-in replaces it. The gateway's startup notice now answers provider precedence from persisted state (no token refresh at boot), so an expired free-tier token cannot stall the online message.
200 lines
7.4 KiB
Python
200 lines
7.4 KiB
Python
"""``hermes portal`` — the human-readable entry point for Nous Portal."""
|
|
from __future__ import annotations
|
|
|
|
import sys
|
|
import webbrowser
|
|
|
|
from hermes_cli.colors import Colors, color
|
|
from hermes_cli.config import load_config
|
|
|
|
DEFAULT_PORTAL_URL = "https://portal.nousresearch.com"
|
|
SUBSCRIPTION_URL = "https://portal.nousresearch.com/manage-subscription"
|
|
DOCS_URL = "https://hermes-agent.nousresearch.com/docs/user-guide/features/tool-gateway"
|
|
# Static `portal tools` catalog — the partners Tool Gateway routes to today: (key, label, partner).
|
|
_CATALOG = [
|
|
("web", "Web search & extract", "Firecrawl"),
|
|
("image_gen", "Image generation", "FAL"),
|
|
("tts", "Text-to-speech", "OpenAI TTS"),
|
|
("browser", "Browser automation", "Browser Use"),
|
|
("modal", "Cloud terminal", "Modal"),
|
|
]
|
|
|
|
|
|
def _feature_state(feat, *, via_nous: str) -> str:
|
|
"""Routing column shared by `portal info` and `portal tools`."""
|
|
if feat.managed_by_nous:
|
|
return color(via_nous, Colors.GREEN)
|
|
if feat.active:
|
|
return feat.current_provider or "active"
|
|
return color("not configured", Colors.DIM)
|
|
|
|
|
|
def _heading(title: str) -> None:
|
|
print()
|
|
print(color(f" {title}", Colors.MAGENTA))
|
|
print(color(" " + "─" * len(title), Colors.MAGENTA))
|
|
|
|
|
|
def _cmd_status(args) -> int:
|
|
"""Show Portal auth + Tool Gateway routing summary."""
|
|
from hermes_cli.auth import get_nous_auth_status_local
|
|
from hermes_cli.nous_subscription import get_nous_subscription_features
|
|
|
|
config = load_config() or {}
|
|
try:
|
|
auth = get_nous_auth_status_local() or {} # refresh-free snapshot
|
|
except Exception:
|
|
auth = {}
|
|
logged_in = bool(auth.get("logged_in"))
|
|
free_tier = bool(auth.get("free_tier"))
|
|
_heading("Nous Portal")
|
|
if free_tier:
|
|
from hermes_cli.anon_auth import FREE_TIER_LABEL, GUEST_MODEL, UPGRADE_HINT
|
|
print(f" Auth: {color(f'{FREE_TIER_LABEL} · {GUEST_MODEL}', Colors.GREEN)}")
|
|
print(f" {UPGRADE_HINT}")
|
|
if auth.get("inference_base_url"):
|
|
print(f" API: {auth['inference_base_url']}")
|
|
elif logged_in:
|
|
print(f" Auth: {color('✓ logged in', Colors.GREEN)}")
|
|
print(f" Portal: {auth.get('portal_base_url') or DEFAULT_PORTAL_URL}")
|
|
if auth.get("inference_base_url"):
|
|
print(f" API: {auth['inference_base_url']}")
|
|
else:
|
|
print(f" Auth: {color('not logged in', Colors.YELLOW)}")
|
|
print(f" Sign up: {SUBSCRIPTION_URL}")
|
|
print(" Login: hermes portal")
|
|
|
|
# Provider selection (independent of auth)
|
|
model_cfg = config.get("model") if isinstance(config.get("model"), dict) else {}
|
|
provider = str(model_cfg.get("provider") or "").strip().lower()
|
|
if provider == "nous":
|
|
print(f" Model: {color('✓ using Nous as inference provider', Colors.GREEN)}")
|
|
elif provider:
|
|
print(f" Model: currently {provider} (switch with `hermes model`)")
|
|
|
|
_heading("Tool Gateway")
|
|
try:
|
|
features = get_nous_subscription_features(config)
|
|
except Exception:
|
|
print(" (could not resolve subscription state)")
|
|
return 0
|
|
rows = [(feat.label, _feature_state(feat, via_nous="via Nous Portal")) for feat in features.items()]
|
|
width = max((len(r[0]) for r in rows), default=0)
|
|
for label, state in rows:
|
|
print(f" {label:<{width}} {state}")
|
|
if not logged_in:
|
|
print()
|
|
print(color(f" Docs: {DOCS_URL}", Colors.DIM))
|
|
return 0
|
|
|
|
|
|
def _cmd_open(args) -> int:
|
|
"""Open the Portal subscription page in the default browser."""
|
|
print(f"Opening {SUBSCRIPTION_URL}")
|
|
try:
|
|
opened = webbrowser.open(SUBSCRIPTION_URL)
|
|
except Exception:
|
|
opened = False
|
|
if opened:
|
|
return 0
|
|
print()
|
|
print("Could not launch a browser. Visit the URL above manually.")
|
|
return 1
|
|
|
|
|
|
def _cmd_tools(args) -> int:
|
|
"""List the Tool Gateway catalog + current routing."""
|
|
from hermes_cli.nous_subscription import get_nous_subscription_features
|
|
|
|
config = load_config() or {}
|
|
try:
|
|
features = get_nous_subscription_features(config)
|
|
except Exception:
|
|
print("Could not resolve Tool Gateway state.", file=sys.stderr)
|
|
return 1
|
|
|
|
_heading("Tool Gateway catalog")
|
|
if not features.nous_auth_present:
|
|
print(color(" Not logged into Nous Portal — sign in with `hermes portal`.", Colors.YELLOW))
|
|
print()
|
|
|
|
label_width = max(len(label) for _, label, _ in _CATALOG)
|
|
for key, label, partner in _CATALOG:
|
|
feat = features.features.get(key)
|
|
state = color("unknown", Colors.DIM) if feat is None else _feature_state(feat, via_nous="✓ via Nous Portal")
|
|
print(f" {label:<{label_width}} partner: {partner:<14} {state}")
|
|
|
|
print()
|
|
print(color(f" Manage your subscription: {SUBSCRIPTION_URL}", Colors.DIM))
|
|
print(color(f" Docs: {DOCS_URL}", Colors.DIM))
|
|
return 0
|
|
|
|
|
|
def _cmd_login(args) -> int:
|
|
"""One-shot Nous Portal onboarding (login + model + provider + tools).
|
|
|
|
Reuses the exact wiring behind ``hermes setup --portal`` so the commands stay in lockstep.
|
|
"""
|
|
from hermes_cli.setup import _run_portal_one_shot
|
|
|
|
config = load_config() or {}
|
|
try:
|
|
_run_portal_one_shot(config)
|
|
except (KeyboardInterrupt, EOFError):
|
|
print()
|
|
print("Portal setup cancelled.")
|
|
return 1
|
|
return 0
|
|
|
|
|
|
# Default (None/"") is the one-shot onboarding (alias for `hermes auth add nous --type oauth` /
|
|
# `hermes setup --portal`). `status` kept as a back-compat alias for `info`.
|
|
_SUBCOMMANDS = {
|
|
None: _cmd_login,
|
|
"": _cmd_login,
|
|
"login": _cmd_login,
|
|
"info": _cmd_status,
|
|
"status": _cmd_status,
|
|
"open": _cmd_open,
|
|
"tools": _cmd_tools,
|
|
}
|
|
|
|
|
|
def portal_command(args) -> int:
|
|
"""Top-level dispatch for `hermes portal <subcommand>`."""
|
|
sub = getattr(args, "portal_command", None)
|
|
handler = _SUBCOMMANDS.get(sub)
|
|
if handler is not None:
|
|
return handler(args)
|
|
print(f"Unknown portal subcommand: {sub}", file=sys.stderr)
|
|
print("Run `hermes portal -h` for usage.", file=sys.stderr)
|
|
return 1
|
|
|
|
|
|
def add_parser(subparsers) -> None:
|
|
"""Register `hermes portal` on the given argparse subparsers object."""
|
|
portal_parser = subparsers.add_parser(
|
|
"portal",
|
|
help="Set up Nous Portal (login, model pick, Tool Gateway); see also `portal info`",
|
|
description=(
|
|
"Run `hermes portal` with no subcommand to log in to Nous Portal "
|
|
"and set it up — pick a model, set Nous as your provider, and offer "
|
|
"the Tool Gateway (the human-readable alias for `hermes auth add "
|
|
"nous --type oauth`, identical to `hermes setup --portal`). "
|
|
"Subcommands: login (default), info, open, tools."
|
|
),
|
|
)
|
|
portal_sub = portal_parser.add_subparsers(dest="portal_command")
|
|
|
|
# `status` is a hidden (no help) back-compat alias; registration order = `hermes portal -h` order.
|
|
for name, help_text in (
|
|
("login", "Log in to Nous Portal + set it up (default; one-shot onboarding)"),
|
|
("info", "Show Portal auth + Tool Gateway routing summary"),
|
|
("status", None),
|
|
("open", "Open the Portal subscription page in your default browser"),
|
|
("tools", "List Tool Gateway tools and which are routed via Nous"),
|
|
):
|
|
portal_sub.add_parser(name, **({} if help_text is None else {"help": help_text}))
|
|
|
|
portal_parser.set_defaults(func=portal_command)
|