hermes-agent/hermes_cli/subcommands/login.py
kshitijk4poor a7ec334448 fix(cli): deprecated hermes login fails gracefully for any provider
`hermes login` was removed in favor of `hermes auth` / `hermes model`, but
the subparser still validated `--provider` against a hardcoded choices list
(nous, openai-codex, xai-oauth). Running `hermes login --provider anthropic`
therefore crashed in argparse with `invalid choice: 'anthropic'` *before* the
deprecation handler could print the redirect to `hermes model` — so a user
trying to authenticate a perfectly valid provider just saw a hard error and
assumed the feature was broken rather than relocated.

- Drop the restrictive `choices=` so every `--provider` value reaches the
  deprecation handler (which ignores the value and prints guidance).
- Omit the subparser `help=` kwarg so the dead command no longer advertises
  itself in `hermes --help` (#24756). Avoids the `==SUPPRESS==` placeholder
  leak that `help=argparse.SUPPRESS` emits for a top-level subparser on 3.12+.
- `hermes login [--flags]` still reaches the actionable deprecation message
  for old scripts/aliases; `hermes login --help` shows the redirect.

Picks up the intent of the inactivity-closed #24902, rebased onto the
post-refactor parser location (hermes_cli/subcommands/login.py) and extended
to fix the whole bug class (any provider value), not just hiding from --help.

Tests: parametrized provider acceptance + help-suppression (no SUPPRESS leak).
2026-06-17 12:55:40 +05:30

78 lines
3.2 KiB
Python

"""``hermes login`` subcommand parser.
Extracted verbatim from ``hermes_cli/main.py:main()`` (god-file Phase 2).
Handler injected to avoid importing ``main``.
"""
from __future__ import annotations
from typing import Callable
def build_login_parser(subparsers, *, cmd_login: Callable) -> None:
"""Attach the deprecated ``login`` subcommand to ``subparsers``.
``hermes login`` was removed in favor of ``hermes auth`` / ``hermes model``
(the runtime handler in ``hermes_cli/auth.py::login_command`` just prints a
deprecation message and exits). The subparser is kept registered so that
old scripts/aliases invoking ``hermes login [--flags]`` still receive the
actionable deprecation message rather than an argparse ``invalid choice:
'login'`` error — but:
- The subparser is registered WITHOUT a ``help=`` kwarg so the row is
omitted from ``hermes --help`` (argparse only lists subcommands that
have a help string). This hides a command that no longer works (#24756)
without the ``help=argparse.SUPPRESS`` ``==SUPPRESS==`` leak that
argparse emits for a top-level subparser on Python 3.12+.
- ``--provider`` accepts ANY value (no ``choices=``) so that, e.g.,
``hermes login --provider anthropic`` reaches the deprecation handler and
gets pointed at ``hermes model`` instead of crashing in argparse with
``invalid choice: 'anthropic'`` before the handler can run.
"""
login_parser = subparsers.add_parser(
"login",
description=(
"Deprecated. Use `hermes auth` to manage credentials, "
"`hermes model` to select a provider, or `hermes setup` for full setup."
),
)
# No ``choices=`` on purpose — the handler is a deprecation notice that
# ignores the value, and a restrictive list would reject providers the user
# legitimately wants (e.g. ``anthropic``) with an argparse error before the
# friendly redirect message is ever printed.
login_parser.add_argument(
"--provider",
default=None,
help="(deprecated) Provider name; ignored — see `hermes model`",
)
login_parser.add_argument(
"--portal-url", help="Portal base URL (default: production portal)"
)
login_parser.add_argument(
"--inference-url",
help="Inference API base URL (default: production inference API)",
)
login_parser.add_argument(
"--client-id", default=None, help="OAuth client id to use (default: hermes-cli)"
)
login_parser.add_argument("--scope", default=None, help="OAuth scope to request")
login_parser.add_argument(
"--no-browser",
action="store_true",
help="Do not attempt to open the browser automatically",
)
login_parser.add_argument(
"--timeout",
type=float,
default=15.0,
help="HTTP request timeout in seconds (default: 15)",
)
login_parser.add_argument(
"--ca-bundle", help="Path to CA bundle PEM file for TLS verification"
)
login_parser.add_argument(
"--insecure",
action="store_true",
help="Disable TLS verification (testing only)",
)
login_parser.set_defaults(func=cmd_login)