߲j*|dZddlZddlZddlmZmZmZddlmZdZ dZ dZ dZ d e d efd Zd ed e fd ZGddZy)aProvider API error summarising for ``AIAgent``. Entitlement-failure detection, xAI subscription decoration, structured-detail coercion, and log-safe redaction of provider error payloads. Extracted from ``run_agent.py``; every method resolves through ``AIAgent``'s MRO unchanged. N)AnyDictOptional)redact_sensitive_text)zexpected ident at linezexpected value at line)z$temporary failure in name resolutionzname or service not knownz,nodename nor servname provided, or not knownzgetaddrinfo failedz#no address associated with hostnameznetwork is unreachableuZ — xAI rejected this OAuth account. NOTE: X Premium+ does NOT include xAI API access — only standalone SuperGrok subscribers can use this provider. Other possible causes: no Grok subscription, your tier doesn't include this model, or your quota is exhausted. Check https://grok.com/?_s=usage to see which, or run `/model` to switch providers.)messagedetailerrorcodetypelowerreturnc:d|vxsd|vxrd|vxs d|vxrd|vS)zYxAI's permission-denied body text for an unsubscribed / under-tiered / exhausted account.z'do not have an active grok subscriptionzout of available resourcesgrokzdoes not have permissionr s user/log-safe summary (see module docstring). error_contextrr c|dvryttsydjfddD}|jsyd|vsd|vryt |S)uDetect subscription/entitlement 401/403s that masquerade as auth failures. Refreshing a token cannot fix an unsubscribed account, so callers surface the error instead of looping the pool. xAI returns the same permission-denied text for BOTH cases; a ``[WKE=unauthenticated:...]`` suffix (or "access token could not be validated") means stale token → return False so the refresh path runs. Disambiguator for xAI (#29344): the same ``code`` text ("The caller does not have permission to execute the specified operation") is returned for BOTH an unsubscribed account AND a stale OAuth access token. xAI ships an explicit signal in the ``error`` field that tells the two apart: a ``[WKE=unauthenticated:...]`` suffix (and/or the ``OAuth2 access token could not be validated`` phrasing) means the credentials failed validation — that's recoverable by refreshing the token, NOT by surfacing an entitlement message. When either signal is present we return False eagerly so the credential-pool refresh path runs, letting long-running TUI sessions recover from stale tokens without an exit/reopen cycle. >NF c3vK|]0}tj|xsdj2yw)rN)strgetr ).0krs r z?ApiErrorSummaryMixin._is_entitlement_failure..Ps4 89C !!!$* + 1 1 3 s69)rreasonr r z[wke=unauthenticated:z*oauth2 access token could not be validated) isinstancedictjoinstripr)rrhaystacks` r_is_entitlement_failurez,ApiErrorSummaryMixin._is_entitlement_failure7sg( . .-.88 =c  ~~ "h .2^bj2j'11rrc\|rt|js|Sd|vr|S|tS)uAppend a neutral hint when xAI's OAuth surface returns the permission-denied 403. xAI's ``/v1/responses`` uses one body for several causes (no subscription, tier lacks the model, quota exhausted). The least obvious: X Premium+ does NOT include API access — only SuperGrok does. Lead with that, keep the raw text, point at https://grok.com/?_s=usage. Idempotent: a substring unique to the hint marks prior decoration. zX Premium+ does NOT include)rr _XAI_ENTITLEMENT_HINT)rs r_decorate_xai_entitlement_errorz4ApiErrorSummaryMixin._decorate_xai_entitlement_errorYs85fllnEM (F 2M/011rvaluecPt|tr|St|trtD]8}|j |}t|ts%|j s6|cStD]%}||vst j||}|s#|cS tj|ddSt|ttfr:|Dcgc]}t j|}}djd|DS|yt|S#t$rt|cYSwxYwcc}w)zBReturn a display-safe string for structured provider error fields.FT) ensure_ascii sort_keysz; c3&K|] }|s| ywNr)r$parts rr&z@ApiErrorSummaryMixin._coerce_api_error_detail..}st@f$rd} YwxYw)uExtract a human-readable one-liner from an API error. Cloudflare HTML pages → ````; network/DNS failures (even SDK-wrapped) → offline hint; else truncated str(error). Nc��������������3���T���K���|�]��}|t��������������j�������������������������v��!�y�wr6���)r"���r ���)r$���markercurrents��� r���r&���z<ApiErrorSummaryMixin._summarize_api_error.<locals>.<genexpr>���s#�����\f6S\//11\s���%(zhHermes can't reach the model provider. You may be offline. Check your internet connection and try again.c��������������3���B���K���|�]��}|j�������������������������v���y�wr6���r���)r$���rF���raws��� r���r&���z<ApiErrorSummaryMixin._summarize_api_error.<locals>.<genexpr>���s�����0s6399;1F0ss���z'Malformed provider streaming response: i,��z <!DOCTYPE<htmlz<title[^>]*>([^<]+)z!HTML error page (title not found)z2Cloudflare Ray ID:\s*]*>([^<]+)zRay u — GeminiAPIErroribodyr rresponsetextri)!r"setidaddany_NETWORK_RESOLUTION_MARKERS __cause__ __context__r( ValueErrorPROVIDER_STREAM_PARSE_MARKERSrresearch IGNORECASEgroupr+appendr*r __name__rrr)r#rr9r0 Exceptionr:loadsJSONDecodeErrorr<)r seenprefixmtitlerayrCrNmsgrOsnippetpayloaderrrGrIs @@r_summarize_api_errorz)ApiErrorSummaryMixin._summarize_api_errors_%j+0!bk&= HHR[ !\@[\\D''>7+>+>G!bk&= eZ (S0sUr0s-s z***...)callabler(r"len)selfr?s r_mask_api_key_for_logsz+ApiErrorSummaryMixin._mask_api_key_for_logssH C=C!5& s8r>bq'#c"#hZ((r error_msgc|sy|jjdsd|vrydj|j}t |dkDr|dddz}|S) zOClean up error messages for user display, removing HTML content and truncating.z Unknown errorzFsm2 22B 2 2 2 22G\IG\#G\G\R )# )(3- ) c c rr)rr:rZtypingrrr agent.redactrrYrUr/r8r"rrr`rrrrrrsq  &&.!U2DCD: :c: mmr