Files
hermes-agent/hermes_cli/portal_cli.py
Siddharth Balyan a2db110ccc feat(auth): Nous free tier: free inference and connectors out of the box, one command to sign in (#105258)
* feat(auth): Nous free tier core: anonymous identity minted on first use, welcome inference, shared-store scoping

A fresh install with no provider sets up a free Nous identity (anonymous auth method of the nous
provider) instead of forcing the setup wizard. The identity is persisted through the same path a
real login uses, so the resolver ladder is unchanged. Two seams differ: token acquisition
re-exchanges the anon credential (no refresh token), and routing pins the welcome host's single
model nous/welcome. One identity per shared store; nous.guest: false turns the free tier off.

* test(auth): free tier core contracts: lifecycle, resolver precedence, exchange seam, model pin

* docs(user-guide): free tier and signing in

New page explaining what a fresh install gets before any key or sign-in
(free inference on nous/welcome plus connectors), how the free tier
coexists with a user's own API key, how to sign in with hermes auth
upgrade and keep connectors, how to turn the free tier off with
nous.guest, what hermes logout does in each state, a troubleshooting
table, and a plain privacy note. Wired into the Using Hermes sidebar.

* fix(auth): logout leaves the free tier alone and clears the shared store for a real Nous account

Logging out of the free tier is a no-op: it is not a login, so nothing is cleared and the user
is told they were never signed in. Logging out of a real Nous account now also clears the
cross-profile store, so a profile logout is not silently re-adopted on the next boot.

* fix(model): switching off the free tier points at signing in, never hops providers

* Name the free tier in the gateway startup notice and tell explicit-provider installs about it once

* Render the Nous free tier as free tier on auth status, auth list, hermes status and portal info, short-circuit billing copy for it, and skip the keepalive when there is no refresh token

* fix(auth): free tier is set up where nothing is configured: resolver last rung and first-run check

Both the provider resolver's terminal rung and the CLI first-run check now try to set up the free
tier before declaring nothing configured. On a fresh install the first command lands in chat on
nous/welcome; a failed setup still falls through to the existing guidance.

* Add hermes auth upgrade: sign the free tier into a Nous account while keeping its connectors

The device-code flow runs as usual, with a promotion intent registered on the portal between the
code request and the token poll so the account that approves the code inherits the free tier's
connectors. The promotion status decides the outcome: only a completed one is followed by the
token grant, which is persisted over the free-tier singleton and the shared store. Declined,
superseded, retired and busy outcomes each print their own plain copy, and a retired identity is
cleared so the next use sets up a fresh one. User-facing text never names the free tier's internals.

* Show the Nous free tier as one picker row with nous/welcome and hide it when nous.guest is off

* fix(auth): upgrade opens the consent page for this sign-in; one mint attempt per process; forced free tier wins the first-run check

The browser leg of hermes auth upgrade now prints and opens the promotion claim URL with the
claim code, not the generic device page. A failed mint is attempted once per process so several
bootstrap sites cannot hit a closed gate or a 429 twice; a retired credential resets that so
re-minting still happens. HERMES_FORCE_GUEST is honoured ahead of the first-run provider check.

* fix(auth): pin the welcome model on the selected route, not on profile state; background setup retries after a failure

A credential-pool entry can select a paid Nous key while the profile singleton is still the free
tier. The model pin now keys on the resolved endpoint (welcome host) in agent init and /model, and
the pin in model normalization is removed since it had no route to look at. A failed background
identity setup releases its latch so a later attempt in the same process can try again.

* fix(auth): decide the Nous model together with the route on every credential-pool swap

The credential pool can move a Nous agent between the welcome host and the portal host after
init. One helper, pin_model_for_route, now runs at init and inside every pool swap, so the
welcome host always carries nous/welcome and a paid endpoint always keeps the caller's model.

* fix(auth): apply the route model policy on every wire mode during a pool swap; release the setup latch if the thread cannot start

* fix(auth): free-tier lifecycle takes profile then shared lock, reconciles with the shared store, persists the mint before exchanging, and clears only the identity that died

The shared store is the identity of record for a Hermes root: a profile holding a stale free-tier
identity adopts a sibling's newer sign-in instead of keeping the guest, and never overwrites the
shared account. Locks are taken in the documented order (profile, then shared). A minted credential
is stored as soon as create succeeds, so a rate-limited or timed-out exchange does not lose it and
trigger a second mint. Retiring a dead credential removes only that credential from both stores.
Guest exchange uses the resolver's canonical portal URL.

* fix(auth): a credential rotation never rewrites the conversation model; connectors honour the off switch and replace a retired free-tier credential

The welcome host serves one model, so a rotation onto it is refused for any conversation on another
model instead of silently switching that conversation to nous/welcome (the model pin applies only
when a route is first chosen). The connector token path now treats the free tier as absent when
nous.guest is false, including cached tokens, and shares the one dead-credential rule with
inference: a retired identity is replaced once rather than returning its stale token.

* fix(auth): plain login never imports the free tier as OAuth credentials; the gateway startup line reads persisted state only

A free-tier identity in the shared store is not an OAuth credential to offer for import; a real
sign-in replaces it. The gateway's startup notice now answers provider precedence from persisted
state (no token refresh at boot), so an expired free-tier token cannot stall the online message.
2026-09-11 03:45:31 +05:30

200 lines
7.4 KiB
Python

"""``hermes portal`` — the human-readable entry point for Nous Portal."""
from __future__ import annotations
import sys
import webbrowser
from hermes_cli.colors import Colors, color
from hermes_cli.config import load_config
DEFAULT_PORTAL_URL = "https://portal.nousresearch.com"
SUBSCRIPTION_URL = "https://portal.nousresearch.com/manage-subscription"
DOCS_URL = "https://hermes-agent.nousresearch.com/docs/user-guide/features/tool-gateway"
# Static `portal tools` catalog — the partners Tool Gateway routes to today: (key, label, partner).
_CATALOG = [
("web", "Web search & extract", "Firecrawl"),
("image_gen", "Image generation", "FAL"),
("tts", "Text-to-speech", "OpenAI TTS"),
("browser", "Browser automation", "Browser Use"),
("modal", "Cloud terminal", "Modal"),
]
def _feature_state(feat, *, via_nous: str) -> str:
"""Routing column shared by `portal info` and `portal tools`."""
if feat.managed_by_nous:
return color(via_nous, Colors.GREEN)
if feat.active:
return feat.current_provider or "active"
return color("not configured", Colors.DIM)
def _heading(title: str) -> None:
print()
print(color(f" {title}", Colors.MAGENTA))
print(color(" " + "─" * len(title), Colors.MAGENTA))
def _cmd_status(args) -> int:
"""Show Portal auth + Tool Gateway routing summary."""
from hermes_cli.auth import get_nous_auth_status_local
from hermes_cli.nous_subscription import get_nous_subscription_features
config = load_config() or {}
try:
auth = get_nous_auth_status_local() or {} # refresh-free snapshot
except Exception:
auth = {}
logged_in = bool(auth.get("logged_in"))
free_tier = bool(auth.get("free_tier"))
_heading("Nous Portal")
if free_tier:
from hermes_cli.anon_auth import FREE_TIER_LABEL, GUEST_MODEL, UPGRADE_HINT
print(f" Auth: {color(f'{FREE_TIER_LABEL} · {GUEST_MODEL}', Colors.GREEN)}")
print(f" {UPGRADE_HINT}")
if auth.get("inference_base_url"):
print(f" API: {auth['inference_base_url']}")
elif logged_in:
print(f" Auth: {color('✓ logged in', Colors.GREEN)}")
print(f" Portal: {auth.get('portal_base_url') or DEFAULT_PORTAL_URL}")
if auth.get("inference_base_url"):
print(f" API: {auth['inference_base_url']}")
else:
print(f" Auth: {color('not logged in', Colors.YELLOW)}")
print(f" Sign up: {SUBSCRIPTION_URL}")
print(" Login: hermes portal")
# Provider selection (independent of auth)
model_cfg = config.get("model") if isinstance(config.get("model"), dict) else {}
provider = str(model_cfg.get("provider") or "").strip().lower()
if provider == "nous":
print(f" Model: {color('✓ using Nous as inference provider', Colors.GREEN)}")
elif provider:
print(f" Model: currently {provider} (switch with `hermes model`)")
_heading("Tool Gateway")
try:
features = get_nous_subscription_features(config)
except Exception:
print(" (could not resolve subscription state)")
return 0
rows = [(feat.label, _feature_state(feat, via_nous="via Nous Portal")) for feat in features.items()]
width = max((len(r[0]) for r in rows), default=0)
for label, state in rows:
print(f" {label:<{width}} {state}")
if not logged_in:
print()
print(color(f" Docs: {DOCS_URL}", Colors.DIM))
return 0
def _cmd_open(args) -> int:
"""Open the Portal subscription page in the default browser."""
print(f"Opening {SUBSCRIPTION_URL}")
try:
opened = webbrowser.open(SUBSCRIPTION_URL)
except Exception:
opened = False
if opened:
return 0
print()
print("Could not launch a browser. Visit the URL above manually.")
return 1
def _cmd_tools(args) -> int:
"""List the Tool Gateway catalog + current routing."""
from hermes_cli.nous_subscription import get_nous_subscription_features
config = load_config() or {}
try:
features = get_nous_subscription_features(config)
except Exception:
print("Could not resolve Tool Gateway state.", file=sys.stderr)
return 1
_heading("Tool Gateway catalog")
if not features.nous_auth_present:
print(color(" Not logged into Nous Portal — sign in with `hermes portal`.", Colors.YELLOW))
print()
label_width = max(len(label) for _, label, _ in _CATALOG)
for key, label, partner in _CATALOG:
feat = features.features.get(key)
state = color("unknown", Colors.DIM) if feat is None else _feature_state(feat, via_nous="✓ via Nous Portal")
print(f" {label:<{label_width}} partner: {partner:<14} {state}")
print()
print(color(f" Manage your subscription: {SUBSCRIPTION_URL}", Colors.DIM))
print(color(f" Docs: {DOCS_URL}", Colors.DIM))
return 0
def _cmd_login(args) -> int:
"""One-shot Nous Portal onboarding (login + model + provider + tools).
Reuses the exact wiring behind ``hermes setup --portal`` so the commands stay in lockstep.
"""
from hermes_cli.setup import _run_portal_one_shot
config = load_config() or {}
try:
_run_portal_one_shot(config)
except (KeyboardInterrupt, EOFError):
print()
print("Portal setup cancelled.")
return 1
return 0
# Default (None/"") is the one-shot onboarding (alias for `hermes auth add nous --type oauth` /
# `hermes setup --portal`). `status` kept as a back-compat alias for `info`.
_SUBCOMMANDS = {
None: _cmd_login,
"": _cmd_login,
"login": _cmd_login,
"info": _cmd_status,
"status": _cmd_status,
"open": _cmd_open,
"tools": _cmd_tools,
}
def portal_command(args) -> int:
"""Top-level dispatch for `hermes portal <subcommand>`."""
sub = getattr(args, "portal_command", None)
handler = _SUBCOMMANDS.get(sub)
if handler is not None:
return handler(args)
print(f"Unknown portal subcommand: {sub}", file=sys.stderr)
print("Run `hermes portal -h` for usage.", file=sys.stderr)
return 1
def add_parser(subparsers) -> None:
"""Register `hermes portal` on the given argparse subparsers object."""
portal_parser = subparsers.add_parser(
"portal",
help="Set up Nous Portal (login, model pick, Tool Gateway); see also `portal info`",
description=(
"Run `hermes portal` with no subcommand to log in to Nous Portal "
"and set it up — pick a model, set Nous as your provider, and offer "
"the Tool Gateway (the human-readable alias for `hermes auth add "
"nous --type oauth`, identical to `hermes setup --portal`). "
"Subcommands: login (default), info, open, tools."
),
)
portal_sub = portal_parser.add_subparsers(dest="portal_command")
# `status` is a hidden (no help) back-compat alias; registration order = `hermes portal -h` order.
for name, help_text in (
("login", "Log in to Nous Portal + set it up (default; one-shot onboarding)"),
("info", "Show Portal auth + Tool Gateway routing summary"),
("status", None),
("open", "Open the Portal subscription page in your default browser"),
("tools", "List Tool Gateway tools and which are routed via Nous"),
):
portal_sub.add_parser(name, **({} if help_text is None else {"help": help_text}))
portal_parser.set_defaults(func=portal_command)