[feat]: add Fireworks AI provider and Fire Pass support

[paraddox]

What does this PR do?

Adds Fireworks AI as a first-class Hermes provider, including Fire Pass support.

This PR wires Fireworks into the existing provider/auth/setup/model-selection flows instead of treating it like a custom endpoint. It uses the standard Fireworks API key and base URL, supports the Fire Pass router model, and keeps Fire Pass
extensible by treating it as a small catalog rather than a one-off hardcoded branch.

For regular Fireworks usage, Hermes now fetches account-scoped Fireworks models at runtime. For Fire Pass, Hermes keeps a curated router list so the setup flow stays reliable even though Fire Pass is a separate product surface.

This approach fits Hermes’s existing provider architecture:

• normal provider registration in auth.py
• setup-time provider/model selection in setup.py
• provider catalog logic in models.py
• no new abstraction or separate fake provider for Fire Pass

Related Issue

Fixes #3510

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• Added fireworks as an API-key provider in hermes_cli/auth.py
• Added Fireworks env metadata in hermes_cli/config.py
• Added Fireworks provider support to interactive setup in hermes_cli/setup.py
• Added Fireworks provider support to hermes model flows in hermes_cli/main.py
• Added Fireworks model catalogs and account-scoped runtime model discovery in hermes_cli/models.py
• Added Fire Pass model support with the current router model catalog
• Added Fire Pass Kimi router context length handling in agent/model_metadata.py
• Added provider aliases, labels, parser support, and auto-provider selection behavior for Fireworks
• Added regression coverage in:
  • tests/hermes_cli/test_models.py
  • tests/hermes_cli/test_setup_model_provider.py
  • tests/test_api_key_providers.py
  • tests/test_setup_model_selection.py
  • tests/test_model_provider_persistence.py
  • tests/test_cli_provider_resolution.py
  • tests/agent/test_model_metadata.py

How to Test

1. Configure a Fireworks key and run:

   source venv/bin/activate
   hermes setup
   

Choose Fireworks AI (open models + Fire Pass) and verify the provider setup completes.

2. Verify model flows:

   hermes model
   hermes chat --provider fireworks -q "hello"
   Confirm Fireworks appears as a normal provider and --provider fireworks is accepted.

3. Run the targeted regression slice:

   source venv/bin/activate
   python -m pytest tests/hermes_cli/test_models.py tests/hermes_cli/test_setup_model_provider.py tests/test_api_key_providers.py tests/test_model_provider_persistence.py tests/test_cli_provider_resolution.py tests/agent/test_model_metadata.py -q

   Expected result:

   • 257 passed, 24 warnings

Checklist

Code

• I've read the Contributing Guide (https://github.com/NousResearch/hermes-agent/blob/main/CONTRIBUTING.md)
• My commit messages follow Conventional Commits (https://www.conventionalcommits.org/) (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs (https://github.com/NousResearch/hermes-agent/pulls) to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: Ubuntu Linux

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide (https://github.com/NousResearch/hermes-agent/blob/main/CONTRIBUTING.md#cross-platform-compatibility) — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

Targeted verification:

$ source venv/bin/activate
$ python -m pytest tests/hermes_cli/test_models.py tests/hermes_cli/test_setup_model_provider.py tests/test_api_key_providers.py tests/test_model_provider_persistence.py tests/test_cli_provider_resolution.py tests/agent/test_model_metadata.py -q
257 passed, 24 warnings in 4.26s

[JSRRosenbaum]

I reviewed this from a security/CI angle and didn’t find a blocking vulnerability in the Fireworks integration itself, but I did hit a few issues that seem worth fixing before merge.

I prepared a local patch that does the following:

• blocks non-TTY API key entry instead of falling back to plain input()
• adds bounded pagination + explicit logging for Fireworks catalog fetches
• sanitizes/rejects unsafe Fireworks model IDs before terminal display
• restores/fixes _setup_provider_model_selection()
• preserves provider autodetect priority so Xiaomi doesn’t get shadowed by Fireworks
• makes the supply-chain audit workflow fork-safe by always writing findings to the job summary and making PR comments best-effort/same-repo only
• adds git to the Docker image for likely git-backed npm dependency resolution issues

Targeted validation I ran locally:

• 181 passed:
  • tests/hermes_cli/test_xiaomi_provider.py
  • tests/hermes_cli/test_api_key_providers.py
  • tests/hermes_cli/test_setup_model_selection.py
• 166 passed:
  • tests/hermes_cli/test_models.py
  • tests/cli/test_cli_provider_resolution.py::test_model_flow_custom_saves_verified_v1_base_url
  • tests/cli/test_cli_provider_resolution.py::test_model_flow_custom_requires_tty_for_api_key_entry
  • tests/agent/test_model_metadata.py
  • tests/agent/test_credential_pool.py

One caveat: my local Docker repro got blocked by a Docker Hub timeout while pulling debian:13.4, so I couldn’t fully re-run the container path end-to-end.

[JSRRosenbaum]

I reviewed and patched the Fireworks integration locally. The security hardening commit is:

• 75be251 — Harden Fireworks provider integration

What it fixes:

• explicit API-key provider priority so Fireworks does not hijack auto-selection
• sanitization of remote Fireworks model IDs before terminal display/use
• bounded Fireworks control-plane pagination
• refusal to prompt for API keys in non-interactive TTY-less contexts

Validation I ran locally:

• python3 -m pytest -q -o addopts='' tests/hermes_cli/test_api_key_providers.py tests/hermes_cli/test_models.py tests/hermes_cli/test_model_provider_persistence.py
• result: 204 passed

I attempted to push directly to the PR head branch, but GitHub denied my account with HTTP 403 despite maintainerCanModify being reported on the PR.

I pushed the hardened branch here instead:

• https://github.com/JSRRosenbaum/hermes-agent/tree/pr-3564-security

You can cherry-pick the fix with:

• git fetch https://github.com/JSRRosenbaum/hermes-agent.git pr-3564-security
• git cherry-pick 75be251

If you want, I can also open a replacement PR against from my branch with the hardening only.

[JSRRosenbaum]

Follow-up: I opened a clean hardening PR from my fork as well:

• Harden Fireworks provider integration #8693

That branch contains commit 75be251 and the targeted regression coverage.

If direct branch updates remain blocked, you can merge or cherry-pick from there instead.

[teknium1]

Fireworks AI support landed via PR #62593. This contribution was part of the Fireworks provider cluster credited in the salvage PR; thank you for the implementation and review work.