This repository has no description
machines.coaxmetal: switch hermes to claude-opus-5-5 on the claude subscription
author
lassulus
date
(Oct 9, 2026, 8:03 PM CEST)
commit
7831898a
7831898adb26f389fe5812c5425fe9ff37347682
parent
31da076a
31da076a14f622ea3c4b7d4b362bc993b40d364e
+31
-35
+31
-35
machines/coaxmetal/hermes.nix
+31
-35
machines/coaxmetal/hermes.nix
···
115
115
];
116
116
117
117
settings.model = {
118
-
# The cluster serves Qwen3.6-27B-FP8 (also aliased as "default" in
119
-
# /v1/models — both resolve to the same weights); pin the explicit id so
120
-
# logs and 400s name the actual model. Verified against the live endpoint
121
-
# that it emits native tool_calls, which Hermes Agent requires.
122
-
default = "Qwen3.6-27B-FP8";
123
-
# hermes's built-in "nous" provider is OAuth-only and hardcodes the dead
124
-
# host inference.nousresearch.com (NXDOMAIN) — true on both 0.17.0 and
125
-
# main, so we drive the cluster's OpenAI-compatible endpoint instead.
118
+
# Claude Opus 5.5 on lass's Claude subscription: the anthropic provider
119
+
# takes the `claude setup-token` OAuth token (sk-ant-oat…) from
120
+
# ANTHROPIC_TOKEN (hermes-anthropic generator below) and sends it as a
121
+
# Bearer token. Anthropic bills third-party apps on subscription tokens
122
+
# as extra usage; hermes renames some tools on the OAuth wire to avoid
123
+
# that classification (agent/anthropic_adapter.py), which goes against
124
+
# Anthropic's usage policies and risks the account. Chosen knowingly.
126
125
#
127
-
# It MUST be a *named* custom provider ("custom:<name>" + a
128
-
# custom_providers entry), not bare "custom". Bare custom resolves its
129
-
# credential from a host-gated candidate list
130
-
# (hermes_cli/runtime_provider.py:1244) that only forwards
131
-
# OPENAI_API_KEY when base_url's host is openai.com — a deliberate
132
-
# anti-credential-leak measure (upstream #28660 / GHSA-76xc-57q6-vm5m).
133
-
# For any other host it silently substitutes the literal placeholder
134
-
# "no-key-required" and the endpoint 401s. A named entry instead reads
135
-
# the key from its declared key_env (runtime_provider.py:692), which is
136
-
# not host-gated. Named entries also ignore config.yaml's model.api_key,
137
-
# so a stray `hermes model` run can no longer shadow this with a stale
138
-
# key (that is exactly how the Nous→cluster switch broke).
139
-
provider = "custom:llama";
140
-
base_url = "https://inference.p0.contact/v1";
141
-
# The custom provider can't auto-detect limits, so unset it leaves
142
-
# context uncompressed and defaults max_tokens to 65536 — once history
143
-
# outgrows the window, input + max_tokens exceeds it and the endpoint
144
-
# 400s ("check the model name and other parameters"). vLLM reports
145
-
# max_model_len 262144 for this model: pin that as the window so hermes
146
-
# compresses in time, and keep a sane output cap (covers thinking +
147
-
# reply) so input + max_tokens always stays under it.
148
-
context_length = 262144;
149
-
max_tokens = 16384;
126
+
# Context (1M) and output (128k) limits come from hermes's own model
127
+
# tables, so nothing is pinned here.
128
+
provider = "anthropic";
129
+
default = "claude-opus-5-5";
150
130
};
151
131
152
-
# The endpoint hermes actually authenticates against. key_env names the
153
-
# env var carrying the token; it comes from the hermes-env generator below
154
-
# via environmentFiles, so the secret never enters the nix store.
155
-
# api_mode is pinned because auto-detection only runs as a fallback.
132
+
# The shared llama cluster stays configured as a named provider, so
133
+
# `/model Qwen3.6-27B-FP8 --provider custom:llama` switches back. Its key
134
+
# comes from hermes-env (key_env), never the nix store. It MUST be a
135
+
# *named* custom provider ("custom:<name>" + this entry), not bare
136
+
# "custom": bare custom resolves its credential from a host-gated list
137
+
# (hermes_cli/runtime_provider.py:1244) that only forwards OPENAI_API_KEY
138
+
# to openai.com and otherwise sends "no-key-required" (upstream #28660 /
139
+
# GHSA-76xc-57q6-vm5m). api_mode is pinned because auto-detection only
140
+
# runs as a fallback.
156
141
settings.custom_providers = [
157
142
{
158
143
name = "llama";
···
559
544
share = true;
560
545
};
561
546
547
+
# Claude subscription OAuth token for the anthropic provider: run
548
+
# `claude setup-token` (long-lived, sk-ant-oat…) and paste it at the
549
+
# prompt. persist=true so it is asked once.
550
+
clan.core.vars.generators.hermes-anthropic.prompts.oauth-token = {
551
+
description = "Claude subscription OAuth token from `claude setup-token` (sk-ant-oat…)";
552
+
type = "hidden";
553
+
persist = true;
554
+
};
555
+
562
556
# Assemble the .env Hermes reads (mirrors the opencrow-env pattern).
563
557
clan.core.vars.generators.hermes-env = {
564
558
dependencies = [
···
566
560
"hermes-llama"
567
561
"hermes-api"
568
562
"radicale-hermes"
563
+
"hermes-anthropic"
569
564
];
570
565
files."hermes.env" = { };
571
566
runtimeInputs = [ pkgs.coreutils ];
···
575
570
LLAMA_API_TOKEN=$(cat "$in"/hermes-llama/llama-api-token)
576
571
API_SERVER_KEY=$(cat "$in"/hermes-api/api_key)
577
572
CALDAV_PASSWORD=$(cat "$in"/radicale-hermes/password)
573
+
ANTHROPIC_TOKEN=$(cat "$in"/hermes-anthropic/oauth-token)
578
574
EOF
579
575
'';
580
576
};