+ Wjl*2a0t$Rt^RIHt^RIt^RIt^RIt^RIHt^RI H t H t ^RI H t ]P!]4t.R OtR]R&.R!OtR]R &R R ltR R ltRRltRRltRRltRRltRRltR"RRlltRRltRRltR#RRlltR#)$z8Codex model discovery from API, local cache, and config.) annotationsN)Path)ListOptional)normalize_route_base_url list[str]DEFAULT_CODEX_MODELSz!list[tuple[str, tuple[str, ...]]]_FORWARD_COMPAT_TEMPLATE_MODELScV^8dQhRR/#)returnr)formats"KC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\codex_models.py __annotate__r9s**)*c>\\PV44#)zOrder-preserving dedupe.)listdictfromkeys model_idss&r_deduper9s  i( ))rc V^8dQhRRRR/#r rrr r )rs"rrr>s  )  rc,a\V4p\V4o\Frwr#VS9gK\;QJdV3RlV4F 'gK RM RM!V3RlV44'gKPVP V4SP V4Kt V#)zSurface newer Codex slugs missing from live discovery when an older compatible template is present (Clawdbot-style synthetic forward-compat catalog).c3,<"TF qS9xK R#5iNr ).0templateseens& r -_add_forward_compat_models..Ds.`P_H4/?P_sTF)rsetr anyappendadd)rorderedsynthetic_modeltemplate_modelsr s& @r_add_forward_compat_modelsr*>soi G w-900k`` large-context picker variants after eligible base slugs. Base slugs keep the cheaper advertised 272K limit; the variant opts into the large window. The suffix is Hermes-side only — stripped before the id hits the wire (agent/transports/codex.py, agent/auxiliary_client.py). )CODEX_CONTEXT_VARIANT_SUFFIXhas_codex_context_variant)agent.model_metadatar-r.r#r%)rr-r.outpresentmodel_idvariants& r_add_context_variantsr4Js_]C)nG 89    $X . . JJw   Jrc V^8dQhRRRR/#rr )rs"rrr_sHHiHIHrc*\\V44#)z;Forward-compat synthesis + large-context variant synthesis.)r4r*rs&r_finalize_codex_modelsr7_s !;I!F GGrc V^8dQhRRRR/#rr )rs"rrrdsGG GiGrcZ^RIHpVUu.uFq!!V4'dKVNK up#uupi)zAstra is account-gated: only the live account-scoped catalog may advertise it. A stale ``models_cache.json`` or a ``config.toml`` default is a compatibility hint, not entitlement.)is_astra_model)agent.reasoning_effortr:)rr:models& r_drop_undiscovered_astrar=ds(6( Fyeu0EEEy FF Fs((cV^8dQhRR/#)r r strr )rs"rrrlsHH3Hrc^RIHpHpV!RR7p\VP R4;'gR4p\ \VP R4;'gR4P 44pV'gR#V!V^4'd RX,#^R IH pV!V4pV'dR PV4MTR ,X,# \dRpLhi;i) aYIdentity of the credential live discovery would use right now, for the catalog cache key. Access/refresh tokens rotate in place while the account-scoped catalog stays authoritative for the same ChatGPT principal and route, so the key includes the principal and resolved base URL, not the rotating token. An expired token is its own state (per route): ``_codex_catalog`` serves the static fallback for it, and that fallback must not outlive the refresh under the healthy principal's key. Opaque non-JWT tokens fall back to the token itself (the caller hashes every part before anything is persisted). )_codex_access_token_is_expiring!resolve_codex_runtime_credentialsT) read_onlyapi_keybase_urlmissingzexpired )_codex_principal_identity/ ) hermes_cli.authrArBr?getrstrip Exceptionagent.credential_poolrHjoin)rArBcredstokenrouterH principals r!codex_catalog_credential_identityrUlsc1DAEIIi(..B/(UYYz-B-H-Hb)I)O)O)QR &ua00U""?)%0I#,CHHY %4 ?% GG s%C (C C CCc V^8dQhRRRR/#)r entriesobjectr rr )rs"rrrs1161i1rcZ.pVEFp\V\4'gKVPR4p\V\4'dVP 4'gK[VPR4p\V\4'd&VP 4P 4R9dKVPR4p\V\ \34'd \ V4MRpVPWcP 434EK VP4\RV44#)aVisible slugs from a Codex catalog ``models`` list, sorted by (priority, slug), deduped. Does not filter on ``supported_in_api``: that flag describes the public OpenAI API, while the OAuth-backed Codex backend still accepts slugs marked false there (gpt-5.3-codex-spark). slug visibilitypriorityi'c3*"TF wrVxK R#5irr )r_rZs& rr! _ranked_slugs..s0xGA4xs>hidehidden) isinstancerrLr?rMlowerintfloatr%sortr)rWsortableitemrZr[r\ranks& r _ranked_slugsrjs H$%% xx$$$DJJLL XXl+ j# & &:+;+;+=+C+C+EI[+[ 88J' *8c5\ B Bs8}zz|,- MMO 0x0 00rc$V^8dQhRRRRRR/#)r access_tokenr?rF Optional[str]r rr )rs"rrrs"::: :QZ:rca a ^RIHp^RIHpT;'gRP 4P R4;'gV!4pV!W4'g.#^RIo ^RIHpRRV 2/V!V4Co ^R IH pV!V V 3R lVR 7wrx\\T44# \d#p \PR T 4.uRp ? #Rp ? ii;i) aFetch available models from the Codex API. Returns visible models sorted by priority. ``base_url`` is the host the credential is routed to (resolved together with it); the catalog is fetched there, never from a host the credential does not belong to (#121486). )_codex_catalog_probe_allowed)_codex_base_urlrErIN)codex_account_headers AuthorizationzBearer )fetch_codex_catalog_entriesc,<SPVS^ R7#) )headerstimeout)rL)urlrvhttpxs&r(_fetch_models_from_api..s #w CrrFz)Failed to fetch Codex models from API: %s)r/rohermes_cli.auth_codexrprMrstripryagent.codex_headersrqrsrNloggerdebugr7rj) rlrFrorp catalog_baserqrsrW_statusexcrvrys && @@r_fetch_models_from_apirs E9 B--/66s;PP?P +LGGI >"gl^$<d@UVb@cdD6 Cl\ "-"8 99  @#F s.B&BB0B C 'C>C C c V^8dQhRRRR/#)r codex_homerr rmr )rs"rrrs O OD O] OrcVR, pVP4'gR#^RIp^RIpVPVPRR74p\ T\ 4'dTPR4MRp\ T\4'd'TP4'dTP4#R# \dR#i;i)z config.tomlN utf-8-sigencodingr<) existstomllibloads read_textrNrbrrLr?rM)r config_pathrpayloadr<s& r_read_default_modelrs},K     -- 5 5{ 5 KL%/w$=$=GKK 4E&uc22u{{}}5;;=N$N s)B33 CCc V^8dQhRRRR/#)r rrr rr )rs"rrrs G G4 GI GrcXVR, pVP4'g.#\P!VPRR74p\ T\ 4'dTPR4MRp\\ T\4'dT4#.4# \d.u#i;i)zmodels_cache.jsonrrmodelsN) rjsonrrrNrbrrLrjr)r cache_pathrawrWs& r_read_cache_modelsrs11J      jj--{-CD$.c4#8#8cgghdG Jw$=$= FF2 FF  s&B B)(B)c$V^8dQhRRRRRR/#)r rlrmrFr rr )rs"rrrs"##m#m#_h#rc \\P!RR4P4;'g&\ \P !4R, 44P 4pV'd \WR7pV'd \V4#^RI H p\V4pT!\\\.V'dV.M.O\V4O\O4444#)aAvailable Codex model IDs: live API (if token) > config.toml default > local cache > defaults. Pass the ``base_url`` resolved together with ``access_token`` (runtime/pool route) so live discovery asks the credential's own host. Without a live answer the result is ``CuratedFallbackModels``: a cache placeholder that never replaces a verified catalog, since account-gated rows such as Astra are absent from the offline hints. CODEX_HOMErEz.codexr|)CuratedFallbackModels)rosgetenvrMr?home expanduserrr7 hermes_cli.models_catalog_staticrrr=rrr)rlrFr api_modelsr default_models&& rget_codex_model_idsrsbii b1779XXSxAW=XYddfJ+LL )*5 5F' 3M !78PQXZ*=/Z6H6TZ ZR 9!"" ##r) gpt-6-sol gpt-6-luna gpt-5.6-sol gpt-5.6-terra gpt-5.6-lunagpt-5.5 gpt-5.4-minigpt-5.4gpt-5.3-codex-spark))r)rr)r)rr)rrr)rr)rr)r)rr)r)rrr)NN)__conditional_annotations____doc__ __future__rrloggingrpathlibrtypingrrhermes_cli.route_identityr getLogger__name__rr__annotations__r rr*r4r7r=rUrjrrrr)rs@rrs>"  !>   8 $ #i . F5!B 5* *H GH810:6 O G##r