dsh-cliworker-now 0.0.0-stage → 0.7.7

package/lib/types/host/hermes-native-entry.py

@@ -0,0 +1,96 @@
+"""Use a verified current native venv with a separate account home, without installing.
+
+The official launcher, checkout-derived install key and committed facts are checked by
+Host. Recheck facts under the same install lock, then use Hermes' own generation lease.
+No account/config content is copied, imported from another home, or printed here.
+"""
+import json
+import os
+from pathlib import Path
+import contextlib
+import logging
+import runpy
+import stat
+import sys
+
+checkout, facts, environment = map(Path, sys.argv[1:4])
+arguments = sys.argv[4:]
+
+def selected():
+    if facts.is_symlink():
+        raise RuntimeError("Invalid Hermes installation record")
+    fd = os.open(facts, os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0) | getattr(os, "O_NONBLOCK", 0))
+    with os.fdopen(fd, encoding="utf-8-sig") as stream:
+        info = os.fstat(stream.fileno())
+        if not stat.S_ISREG(info.st_mode) or info.st_nlink != 1 or info.st_size > 4 * 1024 * 1024:
+            raise RuntimeError("Invalid Hermes installation record")
+        return json.load(stream).get("packages", {}).get("venv", {}).get("environment") == str(environment)
+
+def run_entry():
+    release_holder = []
+    try:
+        return enter(release_holder)
+    finally:
+        for release in release_holder:
+            release()
+
+
+def enter(release_holder):
+    if any(path.resolve() != path for path in (checkout, facts, environment)):
+        raise RuntimeError("Hermes installation changed; reopen login settings")
+    sys.path.insert(0, str(checkout))
+    with open(facts.parent / ".install.lock", "a+b") as lock:
+        if os.name == "nt":
+            from pm.filesystem import lock_fd
+            if not lock_fd(lock.fileno(), wait=False):
+                raise RuntimeError("Hermes installation is being updated; retry after it finishes")
+        else:
+            import fcntl
+            fcntl.flock(lock.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
+        if not selected():
+            raise RuntimeError("Hermes installation changed; reopen login settings")
+        from hermes_cli.runtime_state import lease_generation
+        release_holder.append(lease_generation(environment))
+    os.environ["HERMES_DISABLE_LAZY_INSTALLS"] = "1"
+    os.environ.pop("PYTHONHOME", None)
+    os.environ.pop("PYTHONPATH", None)
+    os.environ.pop("VIRTUAL_ENV", None)
+    sys.argv = [str(checkout / "hermes_cli/main.py"), *arguments]
+    # The native API exposes these boundaries, but main/run_agent pass the
+    # checkout's .env as a fallback. Pin its own home and disable that fallback
+    # and secret-manager hydration before either module imports the function.
+    # No parser or provider/login flow is replaced.
+    account_home = Path(os.environ["HERMES_HOME"])
+    if (account_home / ".cliworker-managed").exists() or (account_home / ".op.env").exists():
+        raise RuntimeError("Hermes plugin login cannot use additional account configuration layers")
+    from hermes_cli import env_loader
+    native_dotenv = env_loader.load_hermes_dotenv
+    def own_dotenv(**_options):
+        if (account_home / ".cliworker-managed").exists():
+            raise RuntimeError("Hermes plugin login cannot use an additional managed configuration")
+        if (account_home / ".op.env").exists():
+            raise RuntimeError("Hermes plugin login supports its own .env; external secret stores are unavailable")
+        return native_dotenv(hermes_home=account_home, project_env=None, load_external_secrets=False)
+    env_loader.load_hermes_dotenv = own_dotenv
+    if arguments and arguments[0].startswith("--cliworker-"):
+        if len(arguments) != 2 or arguments[0] != "--cliworker-nous-refresh":
+            return "unsupported"
+        own_dotenv()
+        operation = runpy.run_path(str(Path(__file__).with_name("hermes-nous-refresh.py")))
+        return operation["refresh_selected_nous"](account_home, arguments[1])
+    from hermes_cli.main import main
+    raise SystemExit(main())
+
+
+if arguments and arguments[0].startswith("--cliworker-"):
+    # Fixed private operation has no native diagnostic/credential output. Keep
+    # SystemExit/KeyboardInterrupt semantics; ordinary failures are classified.
+    with open(os.devnull, "w") as quiet, contextlib.redirect_stdout(quiet), contextlib.redirect_stderr(quiet):
+        logging.disable(logging.CRITICAL)
+        try:
+            result = run_entry()
+        except Exception:
+            result = "unavailable"
+    print(json.dumps({"version": 1, "state": result}, separators=(",", ":")))
+else:
+    run_entry()

package/lib/types/host/hermes-nous-refresh.py

@@ -0,0 +1,331 @@
+"""One bounded, same-account Nous renewal inside the verified native environment.
+
+This module is loaded only by our fixed native-entry operation. Native OAuth
+owns token exchange and atomic persistence. No resolver, pool selection, login,
+anonymous identity, browser, model request or credential output is permitted.
+"""
+import base64
+import contextlib
+import hashlib
+import inspect
+import json
+import logging
+import math
+import os
+from pathlib import Path
+import re
+import signal
+import stat
+import time
+
+PORTAL = "https://portal.nousresearch.com"
+INFERENCE = "https://inference-api.nousresearch.com/v1"
+CLIENT = "hermes-cli"
+MAX_FILE = 4 * 1024 * 1024
+TOKEN_FIELDS = (
+    "access_token", "refresh_token", "token_type", "scope", "client_id",
+    "portal_base_url", "inference_base_url", "obtained_at", "expires_at", "expires_in",
+    "agent_key", "agent_key_id", "agent_key_expires_at", "agent_key_expires_in",
+    "agent_key_reused", "agent_key_obtained_at", "tls",
+)
+TERMINAL = {"invalid_grant", "invalid_token", "refresh_token_reused", "nous_auth_missing_refresh_token"}
+
+
+class Refusal(Exception):
+    def __init__(self, state="changed"):
+        self.state = state
+
+
+def text(value):
+    return isinstance(value, str) and 0 < len(value) <= 32768 and not re.search(r"[\x00-\x20\x7f]", value)
+
+
+def canonical(value, expected):
+    return isinstance(value, str) and value.rstrip("/") == expected
+
+
+def claims(token):
+    if not text(token) or not re.fullmatch(r"[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+", token):
+        raise Refusal()
+    raw = token.split(".")[1]
+    value = json.loads(base64.urlsafe_b64decode(raw + "=" * (-len(raw) % 4)))
+    if not isinstance(value, dict):
+        raise Refusal()
+    return value
+
+
+def scope_values(value):
+    if isinstance(value, str):
+        return re.split(r"[\s,]+", value)
+    if isinstance(value, list):
+        return [part for item in value for part in scope_values(item)]
+    return []
+
+
+def identity(state):
+    if not isinstance(state, dict) or state.get("auth_method") == "anonymous" or state.get("account_tier") == "anonymous":
+        raise Refusal()
+    token = claims(state.get("access_token"))
+    if token.get("account_tier") == "anonymous" or any(not text(token.get(key)) for key in ("sub", "org_id", "iss")):
+        raise Refusal()
+    client = token.get("client_id", "")
+    if client is None:
+        client = ""
+    if client != "" and not text(client):
+        raise Refusal()
+    expiry = token.get("exp")
+    if isinstance(expiry, bool) or not isinstance(expiry, (int, float)) or not math.isfinite(expiry):
+        raise Refusal()
+    if "inference:invoke" not in (scope_values(state.get("scope")) + scope_values(token.get("scope")) + scope_values(token.get("scp"))):
+        raise Refusal()
+    if not canonical(state.get("portal_base_url"), PORTAL) or not canonical(state.get("inference_base_url"), INFERENCE):
+        raise Refusal()
+    native_client = state.get("client_id") or CLIENT
+    if not text(native_client):
+        raise Refusal()
+    key = ["hermes-nous-v1", token["sub"], token["org_id"], token["iss"], client, PORTAL, INFERENCE]
+    digest = hashlib.sha256(json.dumps(key, ensure_ascii=False, separators=(",", ":")).encode("utf-8")).hexdigest()
+    return digest, native_client, float(expiry)
+
+
+def regular_file(path, *, optional=False):
+    try:
+        info = path.lstat()
+    except FileNotFoundError:
+        if optional:
+            return False
+        raise Refusal("unavailable")
+    if not stat.S_ISREG(info.st_mode) or info.st_nlink != 1 or info.st_size > MAX_FILE:
+        raise Refusal()
+    return True
+
+
+def read_json(path):
+    value = json.loads(read_private_text(path))
+    if not isinstance(value, dict):
+        raise Refusal()
+    return value
+
+
+def read_private_text(path):
+    regular_file(path)
+    fd = os.open(path, os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0) | getattr(os, "O_NONBLOCK", 0))
+    with os.fdopen(fd, "rb") as stream:
+        opened = os.fstat(stream.fileno())
+        current = path.lstat()
+        if (not stat.S_ISREG(opened.st_mode) or opened.st_nlink != 1 or opened.st_size > MAX_FILE
+                or stat.S_ISLNK(current.st_mode) or (opened.st_dev, opened.st_ino) != (current.st_dev, current.st_ino)):
+            raise Refusal()
+        data = stream.read(MAX_FILE + 1)
+        if len(data) > MAX_FILE:
+            raise Refusal()
+        return data.decode("utf-8-sig")
+
+
+def check_configuration(home):
+    # The native entry has already loaded only this home's dotenv. Do not import
+    # main/config resolution, which can consult profiles or external sources.
+    import hermes_yaml as yaml
+    config_path = home / "config.yaml"
+    config = yaml.safe_load(read_private_text(config_path))
+    if not isinstance(config, dict) or not isinstance(config.get("model"), dict):
+        raise Refusal()
+    if (config.get("auth") or {}).get("adopt_external_logins") is not False:
+        raise Refusal()
+    model = config["model"]
+    if model.get("provider") != "nous" or (config.get("providers") or {}).get("nous", {}).get("enabled") is False:
+        raise Refusal()
+    if model.get("api_key") or model.get("extra_headers") or any(os.environ.get(k) for k in ("NOUS_API_KEY", "CUSTOM_API_KEY")):
+        raise Refusal()
+    if any(re.fullmatch(r"NOUS_API_KEY_\d+", k) and v for k, v in os.environ.items()):
+        raise Refusal()
+    for value in (model.get("base_url"), os.environ.get("NOUS_INFERENCE_BASE_URL"), os.environ.get("CUSTOM_BASE_URL")):
+        if value and not canonical(value, INFERENCE):
+            raise Refusal()
+    for name in ("NOUS_PORTAL_BASE_URL", "HERMES_PORTAL_BASE_URL"):
+        if os.environ.get(name) and not canonical(os.environ[name], PORTAL):
+            raise Refusal()
+    if model.get("api_mode") not in (None, "chat_completions", "anthropic_messages"):
+        raise Refusal()
+    if (config.get("nous") or {}).get("anthropic_wire", "chat") not in ("chat", "native", "auto"):
+        raise Refusal()
+
+
+def check_available(row):
+    if row.get("disabled") is True or row.get("status") == "exhausted" or row.get("last_status") == "dead":
+        raise Refusal("unavailable")
+    if row.get("last_status") == "exhausted":
+        until = row.get("last_error_reset_at")
+        if not isinstance(until, (int, float)) or isinstance(until, bool) or not math.isfinite(until) or until <= 0 or until > time.time():
+            raise Refusal("unavailable")
+    cooldowns = row.get("model_cooldowns", {})
+    if not isinstance(cooldowns, dict) or any(
+        isinstance(until, (int, float)) and not isinstance(until, bool) and until > time.time()
+        for until in cooldowns.values()
+    ):
+        raise Refusal("unavailable")
+
+
+def checked_pool(store, state, expected):
+    if store.get("active_provider") != "nous" or state.get("agent_key") != state.get("access_token"):
+        raise Refusal()
+    if state.get("last_auth_error", {}).get("relogin_required") is True and not (state.get("access_token") or state.get("refresh_token")):
+        raise Refusal("relogin")
+    check_available(state)
+    rows = store.get("credential_pool", {}).get("nous")
+    if not isinstance(rows, list) or not 1 <= len(rows) <= 8:
+        raise Refusal()
+    for row in rows:
+        if not isinstance(row, dict) or row.get("auth_type") != "oauth" or row.get("source") not in ("device_code", "manual:device_code"):
+            raise Refusal()
+        if row.get("access_token") != state.get("access_token") or row.get("agent_key") != state.get("agent_key"):
+            raise Refusal()
+        if row.get("refresh_token") not in (None, state.get("refresh_token")):
+            raise Refusal()
+        for field, endpoint in (("portal_base_url", PORTAL), ("inference_base_url", INFERENCE), ("base_url", INFERENCE)):
+            if row.get(field) and not canonical(row[field], endpoint):
+                raise Refusal()
+        if (row.get("client_id") or CLIENT) != expected[1]:
+            raise Refusal()
+        check_available(row)
+    return rows
+
+
+def checked_shared(shared, expected):
+    if shared.get("_schema") != 1 or not text(shared.get("refresh_token")):
+        raise Refusal()
+    found = identity(shared)
+    if found[:2] != expected[:2]:
+        raise Refusal()
+    return found
+
+
+def _run(home, expected_digest, cancelled):
+    if not re.fullmatch(r"[a-f0-9]{64}", expected_digest or ""):
+        raise Refusal("unsupported")
+    from hermes_cli import auth
+    from hermes_constants import get_default_hermes_root
+    required = ("_provider_state_transaction", "_auth_file_path", "_nous_shared_store_path", "_nous_shared_store_lock",
+                "_save_provider_state_to_source", "_write_shared_nous_state", "_select_nous_invoke_jwt", "refresh_nous_oauth_from_state")
+    if any(not callable(getattr(auth, key, None)) for key in required):
+        raise Refusal("unsupported")
+    if "on_state_update" not in inspect.signature(auth.refresh_nous_oauth_from_state).parameters:
+        raise Refusal("unsupported")
+    home = Path(home)
+    if home != home.resolve() or not home.is_dir() or get_default_hermes_root().resolve() != home:
+        raise Refusal()
+    auth_path = home / "auth.json"
+    shared_path = auth._nous_shared_store_path()
+    if auth._auth_file_path().resolve() != auth_path or shared_path.parent != home / "shared" or shared_path.resolve() != shared_path:
+        raise Refusal()
+    if (home / "shared").exists() and not (home / "shared").is_dir():
+        raise Refusal()
+    check_configuration(home)
+    raw_ttl = os.environ.get("HERMES_NOUS_MIN_KEY_TTL_SECONDS", "120")
+    if not re.fullmatch(r"\d+", raw_ttl) or len(raw_ttl) > 9:
+        raise Refusal()
+    ttl = max(120, int(raw_ttl))
+    # Native cross-process ordering: auth first, shared second. No profile/global
+    # fallback or shared merge is allowed without the exact selected identity.
+    # Confirm the local provider exists before the native transaction can even
+    # consult a global fallback. Re-read under its lock to bind the snapshot.
+    if not isinstance(read_json(auth_path).get("providers", {}).get("nous"), dict):
+        raise Refusal()
+    with auth._provider_state_transaction("nous", timeout_seconds=1.0) as (store, state, source):
+        snapshot = read_json(auth_path)
+        if source is None or Path(source).resolve() != auth_path or not isinstance(store.get("providers", {}).get("nous"), dict):
+            raise Refusal()
+        if snapshot.get("providers", {}).get("nous") != state or snapshot.get("credential_pool") != store.get("credential_pool"):
+            raise Refusal()
+        check_configuration(home)
+        expected = identity(state)
+        if expected[0] != expected_digest:
+            raise Refusal()
+        rows = checked_pool(store, state, expected)
+        if cancelled[0]:
+            raise Refusal("unavailable")
+        with auth._nous_shared_store_lock(timeout_seconds=1.0):
+            shared = read_json(shared_path) if regular_file(shared_path, optional=True) else None
+            if shared is not None:
+                shared_identity = checked_shared(shared, expected)
+                different_pair = (shared.get("access_token"), shared.get("refresh_token")) != (state.get("access_token"), state.get("refresh_token"))
+                if different_pair and shared_identity[2] == expected[2]:
+                    raise Refusal()
+            else:
+                shared_identity, different_pair = None, False
+
+            def persist(update, _reason=None):
+                nonlocal state
+                merged = {**state, **{key: update[key] for key in TOKEN_FIELDS if key in update}}
+                if identity(merged)[:2] != expected[:2]:
+                    raise Refusal()
+                # Select only this already identity-checked invoke JWT. This has
+                # no network/I/O and keeps pool aliases consistent even if the
+                # pure refresher's later validation fails after token rotation.
+                auth._select_nous_invoke_jwt(merged)
+                if merged.get("agent_key") != merged.get("access_token"):
+                    raise Refusal("unsupported")
+                for row in rows:
+                    for key in TOKEN_FIELDS:
+                        if key in merged:
+                            row[key] = merged[key]
+                auth._save_provider_state_to_source(store, "nous", merged, source)
+                state = merged
+                # Native mirror is best-effort, so verify the saved pair before
+                # reporting ready. No outside-home store is ever touched.
+                auth._write_shared_nous_state(state)
+                saved = read_json(shared_path)
+                if checked_shared(saved, expected)[:2] != expected[:2] or any(saved.get(k) != state.get(k) for k in ("access_token", "refresh_token")):
+                    raise Refusal("unavailable")
+
+            # A newer peer rotation for this exact principal/client/route may
+            # be adopted. Equal-expiry differing tokens are not a proven chain.
+            if different_pair and shared_identity[2] > expected[2]:
+                persist(shared)
+            elif different_pair:
+                # The selected store is provably newer. Repair this same-home,
+                # same-principal mirror before a native resolver can adopt its
+                # older single-use refresh token back into the selected store.
+                persist(state)
+            current = identity(state)
+            if current[2] > time.time() + ttl:
+                return "ready"
+            if not text(state.get("refresh_token")):
+                raise Refusal("relogin")
+            if cancelled[0]:
+                raise Refusal("unavailable")
+            refreshed = auth.refresh_nous_oauth_from_state(
+                state, timeout_seconds=4.0, force_refresh=True, on_state_update=persist)
+            persist(refreshed)
+            if identity(state)[2] <= time.time() + 120:
+                raise Refusal("unavailable")
+            return "unavailable" if cancelled[0] else "ready"
+
+
+def refresh_selected_nous(home, expected_digest):
+    """Fixed safe receipt only. Exceptions and logs never cross the boundary."""
+    cancelled = [False]
+    handlers = {}
+    def on_cancel(_signal, _frame):
+        # Do not interrupt a successful single-use token exchange before its
+        # callback saves the rotation. Host must also await this bounded child
+        # on Windows, where Job termination cannot be deferred by Python.
+        cancelled[0] = True
+    for number in (signal.SIGTERM, signal.SIGINT):
+        handlers[number] = signal.signal(number, on_cancel)
+    old_disable = logging.root.manager.disable
+    try:
+        with open(os.devnull, "w") as quiet, contextlib.redirect_stdout(quiet), contextlib.redirect_stderr(quiet):
+            logging.disable(logging.CRITICAL)
+            try:
+                return _run(home, expected_digest, cancelled)
+            except Refusal as error:
+                return error.state
+            except Exception as error:
+                if getattr(error, "code", None) in TERMINAL and bool(getattr(error, "relogin_required", False)):
+                    return "relogin"
+                return "unavailable"
+    finally:
+        logging.disable(old_disable)
+        for number, handler in handlers.items():
+            signal.signal(number, handler)

package/lib/types/host/hermes-nous.d.ts

@@ -0,0 +1,53 @@
+import type { Effort } from '../shared/types.ts';
+import type { AccountModelScope } from './account-models.mjs';
+export declare const NOUS_PORTAL = "https://portal.nousresearch.com";
+export declare const NOUS_INFERENCE = "https://inference-api.nousresearch.com/v1";
+export declare class HermesNousError extends Error {
+    constructor(message: string);
+}
+export interface HermesNousSource {
+    /** Host only. Never serialize this object in a public response or on disk. */
+    access: string;
+    agentKey: string;
+    expires: number;
+    email?: string;
+    principal: {
+        kind: 'oauth';
+        subject: string;
+        organization: string;
+        issuer: string;
+        clientId?: string;
+    };
+    route: {
+        portal: string;
+        inference: string;
+        anthropicWire?: string;
+    };
+    paidAccess?: boolean;
+    modelCooldowns: Record<string, unknown>[];
+}
+/** Hermes 6c80c327: flat providers.nous, native device-code pool and invoke JWT.
+ * No refresh-only, guest, fallback store or different pooled principal is promoted. */
+export declare function projectHermesNousSource(auth: any, minTtlSeconds?: number, options?: {
+    allowExpired?: boolean;
+}): HermesNousSource;
+export declare function hermesNousMinimumTtl(env: Record<string, string>): number;
+/** Runtime uses its supported MIN_KEY_TTL override (120s), matching the native
+ * invoke-JWT skew. The native default 1800s is a proactive-refresh optimization,
+ * not invalid-account evidence. An explicit own-home setting still takes precedence. */
+export declare function selectHermesNousSource(material: {
+    config: any;
+    auth: any;
+    env: Record<string, string>;
+}, options?: {
+    allowExpired?: boolean;
+}): HermesNousSource;
+export declare function hermesNousEfforts(home: string, source: HermesNousSource, model: string): Effort[];
+export declare function beginHermesNousCapabilities(home: string, source: HermesNousSource): symbol;
+export declare function forgetHermesNousCapabilities(home: string, source: HermesNousSource, generation: symbol): void;
+/** Two read-only, authenticated native endpoints. No public fallback, retry or OAuth refresh. */
+export declare function fetchHermesNousModels(home: string, source: HermesNousSource, options?: {
+    signal?: AbortSignal;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+}, generation?: symbol): Promise<AccountModelScope>;