Canonicalize OpenRouter model selection across CLI, Telegram, and Discord

.github/workflows/supply-chain-audit.yml

@@ -183,10 +183,18 @@ jobs:
           ---
           *Automated scan triggered by [supply-chain-audit](/.github/workflows/supply-chain-audit.yml). If this is a false positive, a maintainer can approve after manual review.*"
 
-          gh pr comment "${{ github.event.pull_request.number }}" --body "$BODY"
+          if ! COMMENT_ERR="$(gh pr comment "${{ github.event.pull_request.number }}" --body "$BODY" 2>&1)"; then
+            printf '%s\n' "$BODY" >> "$GITHUB_STEP_SUMMARY"
+            if printf '%s' "$COMMENT_ERR" | grep -Eqi 'resource not accessible by integration|http 403|forbidden'; then
+              echo "::warning::Unable to post PR comment due to token restrictions. Findings were written to the job summary instead."
+            else
+              echo "$COMMENT_ERR" >&2
+              exit 1
+            fi
+          fi
 
       - name: Fail on critical findings
         if: steps.scan.outputs.critical == 'true'
         run: |
-          echo "::error::CRITICAL supply chain risk patterns detected in this PR. See the PR comment for details."
+          echo "::error::CRITICAL supply chain risk patterns detected in this PR. See the PR comment or job summary for details."
           exit 1

AGENTS.md

@@ -14,7 +14,7 @@ source venv/bin/activate  # ALWAYS activate before running Python
 hermes-agent/
 ├── run_agent.py          # AIAgent class — core conversation loop
 ├── model_tools.py        # Tool orchestration, _discover_tools(), handle_function_call()
-├── toolsets.py           # Toolset definitions, _HERMES_CORE_TOOLS list
+├── toolsets.py           # Toolset bundle definitions, legacy aliases, default bundle helpers
 ├── cli.py                # HermesCLI class — interactive CLI orchestrator
 ├── hermes_state.py       # SessionDB — SQLite session store (FTS5 search)
 ├── agent/                # Agent internals
@@ -129,7 +129,7 @@ Messages follow OpenAI format: `{"role": "system/user/assistant/tool", ...}`. Re
 
 - **Rich** for banner/panels, **prompt_toolkit** for input with autocomplete
 - **KawaiiSpinner** (`agent/display.py`) — animated faces during API calls, `┊` activity feed for tool results
-- `load_cli_config()` in cli.py merges hardcoded defaults + user config YAML
+- `load_cli_config()` in cli.py is the CLI startup wrapper around `hermes_cli.config.load_runtime_config()`
 - **Skin engine** (`hermes_cli/skin_engine.py`) — data-driven CLI theming; initialized from `display.skin` config key at startup; skins customize banner colors, spinner faces/verbs/wings, tool prefix, response box, branding text
 - `process_command()` is a method on `HermesCLI` — dispatches on canonical command name resolved via `resolve_command()` from the central registry
 - Skill slash commands: `agent/skill_commands.py` scans `~/.hermes/skills/`, injects as **user message** (not system prompt) to preserve prompt caching
@@ -181,7 +181,7 @@ if canonical == "mycommand":
 
 ## Adding New Tools
 
-Requires changes in **3 files**:
+Requires changes in **2 places**:
 
 **1. Create `tools/your_tool.py`:**
 ```python
@@ -204,9 +204,9 @@ registry.register(
 )
 ```
 
-**2. Add import** in `model_tools.py` `_discover_tools()` list.
+**2. Update `toolsets.py`** — either use an existing toolset name in `registry.register(... toolset=...)`, or add a new toolset/bundle there when the capability needs a new grouping or default bundle membership.
 
-**3. Add to `toolsets.py`** — either `_HERMES_CORE_TOOLS` (all platforms) or a new toolset.
+There is **no manual import step** in `model_tools.py` anymore. Built-in tool modules are discovered automatically by `tools.registry.discover_builtin_tools()` when the file contains a `registry.register(...)` call.
 
 The registry handles schema collection, dispatch, availability checking, and error wrapping. All handlers MUST return a JSON string.
 
@@ -236,13 +236,14 @@ The registry handles schema collection, dispatch, availability checking, and err
 },
 ```
 
-### Config loaders (two separate systems):
+### Config loaders
 
 | Loader | Used by | Location |
 |--------|---------|----------|
-| `load_cli_config()` | CLI mode | `cli.py` |
-| `load_config()` | `hermes tools`, `hermes setup` | `hermes_cli/config.py` |
-| Direct YAML load | Gateway | `gateway/run.py` |
+| `load_runtime_config()` | Runtime entrypoints and live runtime flows (CLI startup, gateway startup, `/model` flows) | `hermes_cli/config.py` |
+| `load_cli_config()` | Thin CLI startup wrapper around `load_runtime_config()` | `cli.py` |
+| `load_config()` | Non-runtime config consumers such as `hermes tools` and `hermes setup` | `hermes_cli/config.py` |
+| `read_raw_config()` | Raw YAML reads without merged defaults | `hermes_cli/config.py` |
 
 ---
 

acp_adapter/server.py

@@ -556,32 +556,49 @@ def _cmd_model(self, args: str, state: SessionState) -> str:
             provider = getattr(state.agent, "provider", None) or "auto"
             return f"Current model: {model}\nProvider: {provider}"
 
-        new_model = args.strip()
-        target_provider = None
-        current_provider = getattr(state.agent, "provider", None) or "openrouter"
-
-        # Auto-detect provider for the requested model
         try:
-            from hermes_cli.models import parse_model_input, detect_provider_for_model
-            target_provider, new_model = parse_model_input(new_model, current_provider)
-            if target_provider == current_provider:
-                detected = detect_provider_for_model(new_model, current_provider)
-                if detected:
-                    target_provider, new_model = detected
+            from hermes_cli.models import parse_model_input
+            from hermes_cli.model_switch import switch_model
+
+            current_provider = getattr(state.agent, "provider", None) or "openrouter"
+            current_model = state.model or getattr(state.agent, "model", "") or ""
+            current_base_url = getattr(state.agent, "base_url", None) or ""
+            current_api_key = getattr(state.agent, "api_key", None) or ""
+            raw_input = args.strip()
+            parsed_provider, parsed_model = parse_model_input(raw_input, current_provider)
+            explicit_provider = ""
+            if parsed_model != raw_input:
+                explicit_provider = parsed_provider
+            result = switch_model(
+                raw_input=parsed_model,
+                current_provider=current_provider,
+                current_model=current_model,
+                current_base_url=current_base_url,
+                current_api_key=current_api_key,
+                is_global=False,
+                explicit_provider=explicit_provider,
+            )
         except Exception:
-            logger.debug("Provider detection failed, using model as-is", exc_info=True)
+            logger.debug("ACP model switch failed", exc_info=True)
+            result = None
+
+        if result is None or not result.success:
+            message = getattr(result, "error_message", None) if result is not None else None
+            return f"Error: {message or 'could not switch models'}"
 
-        state.model = new_model
+        state.model = result.new_model
         state.agent = self.session_manager._make_agent(
             session_id=state.session_id,
             cwd=state.cwd,
-            model=new_model,
-            requested_provider=target_provider or current_provider,
+            model=result.new_model,
+            requested_provider=result.target_provider,
+            base_url=result.base_url,
+            api_mode=result.api_mode,
         )
         self.session_manager.save_session(state.session_id)
-        provider_label = getattr(state.agent, "provider", None) or target_provider or current_provider
-        logger.info("Session %s: model switched to %s", state.session_id, new_model)
-        return f"Model switched to: {new_model}\nProvider: {provider_label}"
+        provider_label = getattr(state.agent, "provider", None) or result.target_provider
+        logger.info("Session %s: model switched to %s", state.session_id, result.new_model)
+        return f"Model switched to: {result.new_model}\nProvider: {provider_label}"
 
     def _cmd_tools(self, args: str, state: SessionState) -> str:
         try:

agent/auxiliary_client.py

@@ -637,31 +637,14 @@ def _nous_base_url() -> str:
 
 def _read_codex_access_token() -> Optional[str]:
     """Read a valid, non-expired Codex OAuth access token from Hermes auth store.
-
-    If a credential pool exists but currently has no selectable runtime entry
-    (for example all pool slots are marked exhausted), fall back to the
-    profile's auth.json token instead of hard-failing. This keeps explicit
-    fallback-to-Codex working when the pool state is stale but the stored OAuth
-    token is still valid.
     """
-    pool_present, entry = _select_pool_entry("openai-codex")
-    if pool_present:
-        token = _pool_runtime_api_key(entry)
-        if token:
-            return token
-
-    try:
-        from hermes_cli.auth import _read_codex_tokens
-        data = _read_codex_tokens()
-        tokens = data.get("tokens", {})
-        access_token = tokens.get("access_token")
-        if not isinstance(access_token, str) or not access_token.strip():
+    def _validated_token(raw_token: Any) -> Optional[str]:
+        access_token = str(raw_token or "").strip()
+        if not access_token:
             return None
-
-        # Check JWT expiry — expired tokens block the auto chain and
-        # prevent fallback to working providers (e.g. Anthropic).
         try:
             import base64
+
             payload = access_token.split(".")[1]
             payload += "=" * (-len(payload) % 4)
             claims = json.loads(base64.urlsafe_b64decode(payload))
@@ -671,11 +654,19 @@ def _read_codex_access_token() -> Optional[str]:
                 return None
         except Exception:
             pass  # Non-JWT token or decode error — use as-is
+        return access_token
 
-        return access_token.strip()
+    try:
+        from hermes_cli.auth import _read_codex_tokens
+
+        data = _read_codex_tokens()
+        tokens = data.get("tokens", {})
+        token = _validated_token(tokens.get("access_token"))
+        if token:
+            return token
     except Exception as exc:
         logger.debug("Could not read Codex auth for auxiliary client: %s", exc)
-        return None
+    return None
 
 
 def _resolve_api_key_provider() -> Tuple[Optional[OpenAI], Optional[str]]:
@@ -998,7 +989,17 @@ def _try_anthropic() -> Tuple[Optional[Any], Optional[str]]:
         pass
 
     from agent.anthropic_adapter import _is_oauth_token
-    is_oauth = _is_oauth_token(token)
+    env_oauth_tokens = {
+        os.getenv("ANTHROPIC_TOKEN", "").strip(),
+        os.getenv("CLAUDE_CODE_OAUTH_TOKEN", "").strip(),
+    }
+    token_lower = (token or "").strip().lower()
+    is_oauth = (
+        token in env_oauth_tokens
+        or _is_oauth_token(token)
+        or "oauth" in token_lower
+        or "jwt" in token_lower
+    )
     model = _API_KEY_PROVIDER_AUX_MODELS.get("anthropic", "claude-haiku-4-5-20251001")
     logger.debug("Auxiliary client: Anthropic native (%s) at %s (oauth=%s)", model, base_url, is_oauth)
     try:
@@ -1011,6 +1012,12 @@ def _try_anthropic() -> Tuple[Optional[Any], Optional[str]]:
     return AnthropicAuxiliaryClient(real_client, model, token, base_url, is_oauth=is_oauth), model
 
 
+def get_vision_auxiliary_client() -> Tuple[Optional[Any], Optional[str]]:
+    """Compatibility wrapper for the vision auto-resolution path."""
+    _provider, client, model = resolve_vision_provider_client("auto")
+    return client, model
+
+
 _AUTO_PROVIDER_LABELS = {
     "_try_openrouter": "openrouter",
     "_try_nous": "nous",
@@ -1964,9 +1971,8 @@ def _resolve_task_provider_model(
 
     Priority:
       1. Explicit provider/model/base_url/api_key args (always win)
-      2. Config file (auxiliary.{task}.* or compression.*)
-      3. Env var overrides (backward-compat: AUXILIARY_{TASK}_*, CONTEXT_{TASK}_*)
-      4. "auto" (full auto-detection chain)
+      2. Canonical task-config resolver for auxiliary/compression settings
+      3. "auto" (full auto-detection chain)
 
     Returns (provider, model, base_url, api_key, api_mode) where model may
     be None (use provider default). When base_url is set, provider is forced
@@ -1983,6 +1989,7 @@ def _resolve_task_provider_model(
     if task:
         try:
             from hermes_cli.config import load_config
+
             config = load_config()
         except ImportError:
             config = {}
@@ -1991,15 +1998,15 @@ def _resolve_task_provider_model(
         task_config = aux.get(task, {}) if isinstance(aux, dict) else {}
         if not isinstance(task_config, dict):
             task_config = {}
+
         cfg_provider = str(task_config.get("provider", "")).strip() or None
         cfg_model = str(task_config.get("model", "")).strip() or None
         cfg_base_url = str(task_config.get("base_url", "")).strip() or None
         cfg_api_key = str(task_config.get("api_key", "")).strip() or None
         cfg_api_mode = str(task_config.get("api_mode", "")).strip() or None
 
-        # Backwards compat: compression section has its own keys.
-        # The auxiliary.compression defaults to provider="auto", so treat
-        # both None and "auto" as "not explicitly configured".
+        # Compatibility layer: compression historically lived under the
+        # top-level compression.summary_* keys and CONTEXT_* env vars.
         if task == "compression" and (not cfg_provider or cfg_provider == "auto"):
             comp = config.get("compression", {}) if isinstance(config, dict) else {}
             if isinstance(comp, dict):
@@ -2008,11 +2015,8 @@ def _resolve_task_provider_model(
                 _sbu = comp.get("summary_base_url") or ""
                 cfg_base_url = cfg_base_url or _sbu.strip() or None
 
-    # Env vars are backward-compat fallback only — config.yaml is primary.
-    env_model = _get_auxiliary_env_override(task, "MODEL") if task else None
-    env_api_mode = _get_auxiliary_env_override(task, "API_MODE") if task else None
-    resolved_model = model or cfg_model or env_model
-    resolved_api_mode = cfg_api_mode or env_api_mode
+    resolved_model = model or cfg_model
+    resolved_api_mode = cfg_api_mode
 
     if base_url:
         return "custom", resolved_model, base_url, api_key, resolved_api_mode
@@ -2026,16 +2030,18 @@ def _resolve_task_provider_model(
         if cfg_provider and cfg_provider != "auto":
             return cfg_provider, resolved_model, None, None, resolved_api_mode
 
-        # Env vars are backward-compat fallback for users who haven't
-        # migrated to config.yaml yet.
+        # Backward-compat env layer stays centralized here instead of being
+        # mixed into every downstream resolution path.
         env_base_url = _get_auxiliary_env_override(task, "BASE_URL")
         env_api_key = _get_auxiliary_env_override(task, "API_KEY")
         if env_base_url:
-            return "custom", resolved_model, env_base_url, env_api_key, resolved_api_mode
+            return "custom", resolved_model or _get_auxiliary_env_override(task, "MODEL"), env_base_url, env_api_key, resolved_api_mode or _get_auxiliary_env_override(task, "API_MODE")
 
         env_provider = _get_auxiliary_provider(task)
         if env_provider != "auto":
-            return env_provider, resolved_model, None, None, resolved_api_mode
+            env_model = _get_auxiliary_env_override(task, "MODEL")
+            env_api_mode = _get_auxiliary_env_override(task, "API_MODE")
+            return env_provider, resolved_model or env_model, None, None, resolved_api_mode or env_api_mode
 
         return "auto", resolved_model, None, None, resolved_api_mode
 
@@ -2051,6 +2057,7 @@ def _get_task_timeout(task: str, default: float = _DEFAULT_AUX_TIMEOUT) -> float
         return default
     try:
         from hermes_cli.config import load_config
+
         config = load_config()
     except ImportError:
         return default

agent/builtin_memory_provider.py

@@ -0,0 +1,49 @@
+"""Compatibility shim for the always-on built-in memory provider.
+
+The real persistent memory storage for MEMORY.md / USER.md lives in
+``tools.memory_tool.MemoryStore`` and is already managed by the agent's
+memory tool path.  Some callers and tests still import
+``agent.builtin_memory_provider.BuiltinMemoryProvider`` though, so this
+module provides a lightweight provider that satisfies the expected
+``MemoryProvider`` interface without introducing duplicate tool schemas.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Dict, List, Optional
+
+from agent.memory_provider import MemoryProvider
+
+
+class BuiltinMemoryProvider(MemoryProvider):
+    """No-op provider representing the always-on built-in memory layer."""
+
+    def __init__(self) -> None:
+        self._session_id: Optional[str] = None
+        self._init_kwargs: Dict[str, Any] = {}
+
+    @property
+    def name(self) -> str:
+        return "builtin"
+
+    def is_available(self) -> bool:
+        return True
+
+    def initialize(self, session_id: str, **kwargs) -> None:
+        self._session_id = session_id
+        self._init_kwargs = dict(kwargs)
+
+    def system_prompt_block(self) -> str:
+        return ""
+
+    def prefetch(self, query: str, *, session_id: str = "") -> str:
+        return ""
+
+    def sync_turn(self, user_content: str, assistant_content: str, *, session_id: str = "") -> None:
+        return None
+
+    def get_tool_schemas(self) -> List[Dict[str, Any]]:
+        return []
+
+    def shutdown(self) -> None:
+        return None