+ Wj&Rt^RIHt^RIHtHtHt.ROtRRltRRlt RRlt R R lt R R /R Rllt RRlt RRltR#)aUnified provider-credential lifecycle across every store Hermes reads. Deleting a key from ``.env`` alone leaves the stale ``credential_pool`` entry (and the ``provider_models_cache.json`` row) behind, so the provider keeps appearing in the model picker even across restarts (the pool loader is additive-only). Every surface that saves or removes a provider credential should route through :func:`save_provider_env_credential` / :func:`remove_provider_env_credential` so all stores stay consistent. ) annotations)AnyDictListc V^8dQhRRRR/#env_varstrreturn list[str])formats"SC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\credential_lifecycle.py __annotate__rs  C I c^RIHp.pTP4F3wr4YP;'gR9dTP T4K3K5 T# \d.u#i;i \dKZi;i)zCProvider ids whose registered api_key_env_vars include ``env_var``.)PROVIDER_REGISTRYr )hermes_cli.authr Exceptionitemsapi_key_env_varsappend)r rhitspidcfgs& r_providers_for_env_varrs5D%++- //5526 C 7. K     s"A+A& A#"A#& A54A5c(V^8dQhRRRRRRRR/#) r providersr import_pathr argsrr Noner )rs"rrr%s(   )  #  c  d  rc^RIpVPR^4wrE\VPV4V4pVF pV!V.VO5!K R# \dR#i;i)zXBest-effort ``module.fn(provider, *args)`` for every provider; failures never propagate.N.) importlibrsplitgetattr import_moduler)rrr r$ module_namefn_namefnproviders&&* r_for_each_providerr,%s_ *11#q9 Y,,[97 C!H x $ "    sAA AAc V^8dQhRRRR/#rr )rs"rrr2sSYrc ^RIHpHpHpRV 2p.pV!4;_uu_4V!4pVP R4p\ V\ 4'g VuuRRR4#\VP44FpWx,p \ V \4'gK#V U u.uF3p \ V \ 4'dV P R4V8XdK1V NK5 p p \V 4\V 48XdK}VPV4V 'dWV&KWxK V'd V!V4RRR4V#uup i +'giT#;i)zDrop ``credential_pool`` entries seeded from ``env:``; return providers pruned. Spans ALL providers (shared vars like GITHUB_TOKEN seed several). Entries with any other source (OAuth, device-code, manual, borrowed-CLI) are preserved verbatim. )_auth_store_lock_load_auth_store_save_auth_storeenv:credential_poolNsource) rr/r0r1get isinstancedictlistkeyslenr) r r/r0r1r4pruned auth_storepoolr+entriesekepts & r_prune_env_pool_entriesrA2s UTG9 FF   %' ~~/0$%%   TYY[)HnGgt,,&bw!z!T/B/BquuXZ`G`AAwDb4yCL( MM( #!%XN*  Z (% & Mc  & Ms60D6AD6.D1 D1 5D6 D6D61D66 E c$V^8dQhRRRRRR/#)r old_valuer new_valuez str | Noner r r )rs"rrrRs!::#:*::rcJaaaS'g.#^RIHpHpHpV!4pVP 4'g.#V!V4pT'g.#.oRRTTT3RlllpRRlpT!TP R4R4T!TP R4R4FwrT!T R T 24K T!TP R 4R 4FwrT!T R T 24K T!TP R 4R4FwrT!T RT 2RR7K S'd T!YV4S# \ d.u#i;i)aAReconcile config.yaml api_key mirrors holding ``old_value``; return dotted paths touched. Value-matched on purpose: only an entry holding the SAME credential that just changed in ``.env`` is touched. ``new_value=None`` removes the field. Operates on the RAW user config so defaults are never baked into the user's file. )atomic_config_replaceget_config_pathread_user_config_rawc(V^8dQhRRRRRRRR/#) rsectionrkey_pathr fieldsztuple[str, ...]r r!r )rs"rr0_scrub_config_yaml_mirrors..__annotate__is) 6 6c 6S 6/ 6[_ 6rc<\V\4'gR#VFjpVPV4p\V\4'gK,VS8XgK5S'dSW&MVP VR4SP V RV 24Kl R#)Nr#)r6r7r5r popr)rJrKrLfieldcurrentrDrCtoucheds&&& r_fix(_scrub_config_yaml_mirrors.._fixisp'4(( Ekk%(G'3''Gy,@%.GNKKt,(1UG45rc V^8dQhRRRR/#)rvaluer allow_listboolr )rs"rrrMxsRRcRtRrc\V\4'dVP4#V'd"\V\4'd \ V4#R#)Nr )r6r7rr8 enumerate)rVrWs&&r_items*_scrub_config_yaml_mirrors.._itemsxs9 eT " ";;= #-*UD2I2IyQrQrmodel auxiliaryFz auxiliary.custom_providersTzcustom_providers.rz providers.)rL))api_keyapi)r`)hermes_cli.configrFrGrHexistsrr5)rCrDrFrGrH config_path user_configrSr[taskslot_cfgnameentry provider_idrRsff @r_scrub_config_yaml_mirrorsrkRs,  ^^!#K      *;7   G 6 6R   !7+ !=uE XD6*+Fkoo.@A4H  U'v./I%[__[%A5I  Uj .|DJk7 NU  sD D"!D"clear_models_cacheTc$V^8dQhRRRRRR/#)rr r rlrXr dict[str, Any]r )rs"rrrs$;; ;)-;9G;rc\V4p\\V4\\V44,4p\ VRRV 24V'dV'd \ VR4RVRV/#)zRemove non-.env references to an env-var credential. Prunes env-seeded pool entries and (optionally) the affected ``provider_models_cache.json`` rows so the model picker stops advertising a provider whose key is gone. See #59761. z*hermes_cli.auth.suppress_credential_sourcer2z-hermes_cli.models.clear_provider_models_cache pool_prunedr)rAsortedsetrr,)r rlr;rs&$ rpurge_env_credential_referencesrssd%W -Fs6{S)?)H%IIJIy"NRVW^V_P`ai9&UV 6; ::rc$V^8dQhRRRRRR/#)rr r rVr rnr )rs"rrrs&$J$J#$Jc$Jn$Jrc^RIHpHpHpV!VR4V!4P V4pV!W4.pV'dV'dWQ8wd \ WQ4p\ V4p\VRRV 24\VR4RRRVR V/#) uSave/update a credential in ``.env`` and reconcile every mirror. config.yaml mirrors of the PREVIOUS value are updated so a stale higher-precedence copy cannot shadow the rotation, and ``load_pool()`` runs now so the env-seeded ``credential_pool`` entry lands in ``auth.json`` (a ``.env``-only write left env-backed providers 401'ing). Suppressed ``env:`` pool sources are re-enabled so a deliberate re-add through the UI behaves like ``hermes auth add``. See #62269. The save also forces an immediate ``load_pool()`` for every provider registered against this env var so the env-seeded ``credential_pool`` entry is materialized to ``auth.json`` right now — the live runtime reads from the pool, and before #96058 the Desktop "Save" action only touched ``.env`` while ``auth.json``'s mtime stayed unchanged, so an OpenCode Go (or any other env-backed provider) request kept 401'ing until the user ran ``hermes auth add --type api-key`` separately. This makes the Desktop save's effect on disk match what ``hermes auth add`` does. )load_envrequire_env_writablesave_env_valuerrz,hermes_cli.auth.unsuppress_credential_sourcer2zagent.credential_pool.load_poolokTkeyconfig_updates)rbrvrwrxr5rkrr,)r rVrvrwrxrCr{rs&& rsave_provider_env_credentialr|s QP%( w'I7" "N y13IE'w/Iy"PTXY`XaRbcy"CD $w(8. IIrc V^8dQhRRRR/#)rr r r rnr )rs"rrrsSSCSNSrc*^RIHpHpHpV!VR4V!4P V4pV!V4p\ V4pV'd \ VR4M.pRRRTRTRVR,R VR ,R TR \T;'gVR,;'gT4/#) zRemove a credential from EVERY store: ``.env`` (and process env), env-seeded ``credential_pool`` entries, model-cache rows, config.yaml mirrors of the same value.)rvremove_env_valuerwremoveNryTrzremovedrprconfig_scrubbedfound)rbrvrrwr5rsrkrX)r rvrrwrCremoved_from_envrefsrs& rremove_provider_env_credentialrsSR(+ w'I'0 *7 3DEN0DATVO d w#tM*T+&?&PP$}*=PPQ SSrN)rsrr|)__doc__ __future__rtypingrrr__all__rr,rArkrsr|rr rrrsL#""    @:z;04;*$JNSr