71704ffb49
The spotify toolset (plugins/spotify) and its loopback-PKCE login (hermes_cli/auth_spotify.py)
now live in NousResearch/hermes-spotify, installed from the plugin catalog. Same pattern as the
Home Assistant move (fb9fc8a3dd): a LEFT_CORE row installs the plugin for every home that was
using it (a Spotify login in auth.json, or the spotify toolset in platform_toolsets) on
`hermes update` / first start; the toolset name, tool names, schemas, env vars and stored login
(providers.spotify) are unchanged, so nobody re-authenticates.
The one user-visible change is the login command: plugins cannot extend `hermes auth`, so the
plugin registers `hermes spotify login|status|logout`. LeftCoreFeature gains a `cli` field and
moved_command_hint() turns `hermes auth [status|logout] spotify`, and `hermes spotify` while the
plugin is not loaded, into a line naming the new command and the install/enable step for this
home. The dashboard's "needs login" hint names the new command too.
Core drops the Spotify auth constants/dispatch, the CONFIGURABLE_TOOLSETS row and post-setup
step, the core `spotify` entries in the shared-metrics toolset enums, its tests, and the docs
(en + zh-Hans) now point at `hermes plugins install spotify` / `hermes spotify login`.
73 lines
4.3 KiB
Python
73 lines
4.3 KiB
Python
"""``hermes auth`` subcommand parser."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from typing import Callable
|
|
|
|
|
|
def build_auth_parser(subparsers, *, cmd_auth: Callable) -> None:
|
|
"""Attach the ``auth`` subcommand to ``subparsers``."""
|
|
auth_parser = subparsers.add_parser("auth", help="Manage pooled provider credentials")
|
|
auth_subparsers = auth_parser.add_subparsers(dest="auth_action")
|
|
auth_add = auth_subparsers.add_parser("add", help="Add a pooled credential")
|
|
auth_add.add_argument(
|
|
"provider", help="Provider id (for example: anthropic, openai-codex, openrouter)")
|
|
auth_add.add_argument(
|
|
"--type", dest="auth_type", choices=["oauth", "api-key", "api_key"],
|
|
help="Credential type to add")
|
|
auth_add.add_argument("--label", help="Optional display label")
|
|
auth_add.add_argument(
|
|
"--priority", type=int,
|
|
help="Place the new credential at this priority (0 = tried first under fill_first); "
|
|
"appends last when omitted")
|
|
auth_add.add_argument("--api-key", help="API key value (otherwise prompted securely)")
|
|
auth_add.add_argument("--portal-url", help="Nous portal base URL")
|
|
auth_add.add_argument("--inference-url", help="Nous inference base URL")
|
|
auth_add.add_argument("--client-id", help="OAuth client id")
|
|
auth_add.add_argument("--scope", help="OAuth scope override")
|
|
auth_add.add_argument(
|
|
"--no-browser", action="store_true", help="Do not auto-open a browser for OAuth login")
|
|
auth_add.add_argument(
|
|
"--browser", action="store_true",
|
|
help="openai-codex only: sign in with the browser authorization-code (PKCE) flow on "
|
|
"http://localhost:1455/auth/callback instead of the default device-code flow; falls back "
|
|
"to device code when that port is busy (config: auth.codex_login_flow)")
|
|
auth_add.add_argument("--timeout", type=float, help="OAuth/network timeout in seconds")
|
|
auth_add.add_argument(
|
|
"--insecure", action="store_true", help="Disable TLS verification for OAuth login")
|
|
auth_add.add_argument("--ca-bundle", help="Custom CA bundle for OAuth login")
|
|
auth_list = auth_subparsers.add_parser("list", help="List pooled credentials")
|
|
auth_list.add_argument("provider", nargs="?", help="Optional provider filter")
|
|
auth_remove = auth_subparsers.add_parser(
|
|
"remove", help="Remove a pooled credential by index, id, or label")
|
|
auth_remove.add_argument("provider", help="Provider id")
|
|
auth_remove.add_argument("target", help="Credential index, entry id, or exact label")
|
|
auth_reset = auth_subparsers.add_parser(
|
|
"reset", help="Clear exhaustion status for a provider's credentials (all, or one target)")
|
|
auth_reset.add_argument("provider", help="Provider id")
|
|
auth_reset.add_argument(
|
|
"target", nargs="?",
|
|
help="Optional credential index, entry id, or exact label; clears every credential when omitted")
|
|
auth_priority = auth_subparsers.add_parser(
|
|
"priority", help="Move a pooled credential to a priority (0 = tried first under fill_first)")
|
|
auth_priority.add_argument("provider", help="Provider id")
|
|
auth_priority.add_argument("target", help="Credential index, entry id, or exact label")
|
|
auth_priority.add_argument("priority", type=int, help="New priority; others are renumbered")
|
|
auth_refresh = auth_subparsers.add_parser(
|
|
"refresh", help="Refresh a pooled OAuth credential's tokens and clear its cooldown")
|
|
auth_refresh.add_argument("provider", help="Provider id")
|
|
auth_refresh.add_argument(
|
|
"target", nargs="?",
|
|
help="Credential index, entry id, or exact label (required when the pool holds more than one)")
|
|
auth_status = auth_subparsers.add_parser("status", help="Show auth status for a provider")
|
|
auth_status.add_argument("provider", help="Provider id")
|
|
auth_logout = auth_subparsers.add_parser(
|
|
"logout", help="Log out a provider and clear stored auth state")
|
|
auth_logout.add_argument("provider", help="Provider id")
|
|
auth_upgrade = auth_subparsers.add_parser(
|
|
"upgrade", help="Sign in with a Nous account, keeping your connectors")
|
|
auth_upgrade.add_argument(
|
|
"--no-browser", action="store_true", help="Do not auto-open a browser for sign-in")
|
|
auth_upgrade.add_argument("--timeout", type=float, help="Network timeout in seconds")
|
|
auth_parser.set_defaults(func=cmd_auth)
|