e946f49ab5
* fix(file_tools): block agent writes to ~/.hermes/config.yaml to prevent silent approval bypass * fix(approval): pair terminal-side gate for ~/.hermes/config.yaml writes Subway2023's #14639 blocks write_file/patch to ~/.hermes/config.yaml, but the terminal side was only partially paired: echo>/tee/cp/mv to config.yaml already tripped the project-config pattern, while `sed -i` and direct edits slipped through with auto-approve. An unpaired write_file deny is theater per SECURITY.md — the agent could flip approvals.mode=off via `sed -i` and the mtime-keyed config cache reloads it mid-session. config.yaml IS the security policy (approvals.mode/yolo/permanent allowlist live there), so it warrants real pairing, not a half-door. Add a _HERMES_CONFIG_PATH fragment mirroring _HERMES_ENV_PATH, fold it into _SENSITIVE_WRITE_TARGET (covers tee/>/>>/cp/mv), and add sed -i coverage for both config.yaml and .env. Pins 9 regression tests including no-regression guards (reads pass, /tmp writes pass). Co-authored-by: sbw2025 <subw3@mail2.sysu.edu.cn> * chore(release): map Subway2023 for PR #14639 salvage * fix(models): add gemini-3.5-flash to Gemini OAuth + API-key pickers #34581 swapped gemini-3-flash-preview -> gemini-3.5-flash in the OpenRouter and Nous lists but missed the curated Gemini catalogs, so the Google OAuth (google-gemini-cli) picker still offered the retired gemini-3-flash-preview slug and gemini-3.5-flash was unselectable. Per Google's docs gemini-3-flash-preview was renamed to gemini-3.5-flash and is served via Cloud Code Assist, so this completes the rename for: - google-gemini-cli (OAuth/Code Assist) picker - gemini (API-key) picker - gemini provider default_aux_model copilot keeps gemini-3-flash-preview (separate backend, own slug). --------- Co-authored-by: sbw2025 <subw3@mail2.sysu.edu.cn>
73 lines
2.6 KiB
Python
73 lines
2.6 KiB
Python
"""Google Gemini provider profiles.
|
|
|
|
gemini: Google AI Studio (API key) — uses GeminiNativeClient
|
|
google-gemini-cli: Google Cloud Code Assist (OAuth) — uses GeminiCloudCodeClient
|
|
|
|
Both report api_mode="chat_completions" but use custom native clients
|
|
that bypass the standard OpenAI transport. The profile captures auth
|
|
and endpoint metadata for auth.py / runtime_provider.py migration, and
|
|
carries the thinking_config translation hook so the transport's profile
|
|
path produces the same extra_body shape the legacy flag path did.
|
|
"""
|
|
|
|
from typing import Any
|
|
|
|
from providers import register_provider
|
|
from providers.base import ProviderProfile
|
|
|
|
|
|
class GeminiProfile(ProviderProfile):
|
|
"""Gemini — translate reasoning_config to thinking_config in extra_body."""
|
|
|
|
def build_extra_body(
|
|
self, *, session_id: str | None = None, **context: Any
|
|
) -> dict[str, Any]:
|
|
"""Emit extra_body.thinking_config (native) or extra_body.extra_body.google.thinking_config
|
|
(OpenAI-compat /openai subpath), mirroring the legacy path's behavior.
|
|
"""
|
|
from agent.transports.chat_completions import (
|
|
_build_gemini_thinking_config,
|
|
_is_gemini_openai_compat_base_url,
|
|
_snake_case_gemini_thinking_config,
|
|
)
|
|
|
|
model = context.get("model") or ""
|
|
reasoning_config = context.get("reasoning_config")
|
|
base_url = context.get("base_url") or self.base_url
|
|
|
|
raw_thinking_config = _build_gemini_thinking_config(model, reasoning_config)
|
|
if not raw_thinking_config:
|
|
return {}
|
|
|
|
body: dict[str, Any] = {}
|
|
if self.name == "gemini" and _is_gemini_openai_compat_base_url(base_url):
|
|
thinking_config = _snake_case_gemini_thinking_config(raw_thinking_config)
|
|
if thinking_config:
|
|
body["extra_body"] = {"google": {"thinking_config": thinking_config}}
|
|
else:
|
|
body["thinking_config"] = raw_thinking_config
|
|
return body
|
|
|
|
|
|
gemini = GeminiProfile(
|
|
name="gemini",
|
|
aliases=("google", "google-gemini", "google-ai-studio"),
|
|
api_mode="chat_completions",
|
|
env_vars=("GOOGLE_API_KEY", "GEMINI_API_KEY"),
|
|
base_url="https://generativelanguage.googleapis.com/v1beta",
|
|
auth_type="api_key",
|
|
default_aux_model="gemini-3.5-flash",
|
|
)
|
|
|
|
google_gemini_cli = GeminiProfile(
|
|
name="google-gemini-cli",
|
|
aliases=("gemini-cli", "gemini-oauth"),
|
|
api_mode="chat_completions",
|
|
env_vars=(), # OAuth — no API key
|
|
base_url="cloudcode-pa://google", # Cloud Code Assist internal scheme
|
|
auth_type="oauth_external",
|
|
)
|
|
|
|
register_provider(gemini)
|
|
register_provider(google_gemini_cli)
|