߲jeBdZddlmZddlZddlZddlZddlmZmZddlm Z ddl m Z m Z ddl mZddlmZej"eZd Zd Zd Ze d GddZd)dZdZd*dZd+dZd,dZd-dZd-dZd-dZd.d/dZ d0dZ!d1dZ" d2 d3dZ# d2 d4dZ$ddl%m&Z&ddl%m&Z&dZ' d5 d6dZ( d2 d7d Z)d!Z*d"Z+d#Z,d0d$Z- d2 d8d%Z.d1d&Z/d1d'Z0 d5 d9d(Z1y):zIGeneric managed-tool gateway helpers for Nous-hosted vendor passthroughs.) annotationsN)datetimetimezone) dataclass)CallableOptionalget_hermes_home)managed_nous_tools_enabledznousresearch.comhttpsxT)frozenc6eZdZUded<ded<ded<ded<y)ManagedToolGatewayConfigstrvendorgateway_originnous_user_tokenbool managed_modeN)__name__ __module__ __qualname____annotations__?/home/ubuntu/.hermes/hermes-agent/tools/managed_tool_gateway.pyrrs Krrcft|tr |jr|jSdS)z:*value* stripped when it is a non-blank string, else None.N) isinstancerstrip)values r_cleanr"s$&uc2u{{}5;;=N$Nrctdz S)zDReturn the Hermes auth store path, respecting HERMES_HOME overrides.z auth.jsonr rrrauth_json_pathr$#s  { **rc ddlm}|d}t|tsyddlm}m}||r|sy|S#t$rYywxYw)aUThe profile's Nous state, or None. A free-tier identity counts only while the free tier is on: with ``nous.guest: false`` it is invisible here, so no cached or refreshed token of it is ever attached to a request. Resolves through the same profile-then-global-root fallback every other credential reader uses: a profile created with ``share_auth`` has no ``auth.json`` of its own and signs in with the root identity. Reading only ``HERMES_HOME/auth.json`` made that profile look signed out to the connector gate alone, so ``manage_connections`` vanished from its tool list.r)get_provider_auth_statenousN) guest_enabledis_guest_state)hermes_cli.authr&rdicthermes_cli.anon_authr(r) Exception)r& nous_providerr(r)s r_read_nous_provider_stater/(sK ;/7 -.F - ( s;;; AAc0t|}|y tj|jdr|dddzn|}|j |n|j tjjtjS#t$rYywxYw)NZz+00:00)tzinfo) r"r fromisoformatendswith ValueErrorr3replacerutc astimezone)r! normalizedparseds r_parse_timestampr<@sJ''jFYFYZ]F^ 3B((Bdnomm/FV^^8<<^5X d demeqeq rr s.B BBct|}|duxsJ|tjtjz j t dt|kS)Nr)r<rnowrr8 total_secondsmaxint) expires_at skew_secondsexpiress r_access_token_is_expiringrEKsKz*G d? qwhll)CCRRTX[\]_bco_pXqqqrc ddlm}m} |d}t |S#|$rtjd}Y'wxYw#t $r"tjd}Yt |SwxYw)zRead the TOOL_GATEWAY_USER_TOKEN override through the secret scope. Scope verdict is authoritative when installed (a scoped miss must NOT borrow the process env under multiplex); ``os.environ`` only when unscoped.r)UnscopedSecretError get_secretTOOL_GATEWAY_USER_TOKEN)agent.secret_scoperGrHosgetenvr-r")rGrHexplicits r_read_user_token_overriderNPso8F <!";;>;>A)(A)cftxs&ttxsijdS)uCheap token probe: env override or cached auth-store token, no expiry check and no network — availability scans must stay off the synchronous OAuth refresh path (:func:`read_nous_access_token`). access_token)rNr"r/getrrrpeek_nous_access_tokenrR_s- % & i&2K2M2SQS1X1XYg1h*iirctx}r|Stxsi}|syt}|r!t|j dt s|S ddlm}t|t x}r|S |S#t$r[}ddl m }t||r(t|t|jxsdcYd}~St j#d|Yd}~|Sd}~wwxYw) aRead a Nous Subscriber OAuth access token from auth store or env override. A read: with no Nous identity there is no bearer and the answer is None. The free-tier identity is created by the boot bootstrap (``hermes_cli.free_tier_bootstrap``), never on a token-read path (NS-845 Q1.2). A retired free-tier credential IS replaced here, once: that is the explicit dead-credential rule, shared with inference. NrBrresolve_nous_access_tokenrefresh_skew_seconds)AnonCredentialDeadanon_credential_deadz$Nous access token refresh failed: %s)rNr/rRrErQ'_NOUS_ACCESS_TOKEN_REFRESH_SKEW_SECONDSr*rUr"r-r,rXr_replace_dead_guest_tokenrcodeloggerdebug)rMr. cached_tokenrUrefreshed_tokenexcrXs rread_nous_access_tokenrbes-..x.-/52M )+L5m6G6G 6UW~ B=$%>T{%|} }? }" " ~  B < c- .,]C@bLbhttpr z-TOOL_GATEWAY_SCHEME must be 'http' or 'https')rKrLr lower_DEFAULT_TOOL_GATEWAY_SCHEMEr6)schemes rget_tool_gateway_schemerqsE YY,b 1 7 7 9 ? ? A aEaF &&HII MrcLtj|jjddddj j dx}r|Stjddj j dxst }td|d|S) z0Return the gateway origin for a specific vendor.-_ _GATEWAY_URLrl/TOOL_GATEWAY_DOMAIN://z -gateway.)rKrLupperr7r rstrip_DEFAULT_TOOL_GATEWAY_DOMAINrq)rexplicit_vendor_url shared_domains rbuild_vendor_gateway_urlr~s ii6<<>+A+A#s+K*LL(Y[]^ddfmmnqrrr""II3R8>>@FFsKkOkM%' (F89]O LLrc~tsy|xst|}|xst}|r|syt|||dS)z8Resolve shared managed-tool gateway config for a vendor.NT)rrrr)r r~rbr)rgateway_builder token_readerrrs rresolve_managed_tool_gatewayrsT & 'AoA)A6JN=|='=@O  #6.bqAE FFrc2t|||xstduS)zTrue when a gateway URL and a likely-usable Nous token are present. Defaults to :func:`peek_nous_access_token` (no OAuth refresh); callers about to make a real request use :func:`resolve_managed_tool_gateway` instead.)rrN)rrR)rrrs ris_managed_tool_gateway_readyrs5 (^j_EoE FNR RRr)urlsplittoolcdt|tr|jsy|xst} t |t }t |j}t|jxr1|j|jf|j|jfk(S#t $rYywxYw)uTrue when ``url`` is on the Nous tool-gateway origin this client builds. Anything granting a URL extra trust — our bearer, reading files off disk to upload — must gate on this rather than on a name, so an arbitrary URL can never inherit that trust. F) rrr r~r_MANAGED_GATEWAY_VENDORr6rrpnetloc)urlrbuilderexpectedactuals ris_managed_nous_gateway_urlrs c3 syy{9!9GG$;<=#))+&   gFMM6==#AhooW_WfWfEg#gg s.B## B/.B/ct||siS|xst} |}t |t r|jsiSdd|jiS#t$r#}tj d||icYd}~Sd}~wwxYw)aLive auth headers for a managed gateway URL, or ``{}`` when not managed. Read fresh on every call rather than cached: a Nous access token expires within the hour, and a long session would otherwise keep presenting a dead bearer. Returns ``{}`` rather than raising when no token is available, so a caller can report "sign in" instead of sending an unauthenticated request. z,Managed gateway token read failed for %s: %sN AuthorizationzBearer )rrbr-r]r^rrr )rrrresolved_token_readertokenras rmanaged_gateway_auth_headersrs 'sO < (B,B%' eS ! wu{{}o6 77  CS#N sA B!A?9B?Bg.@gN@gr@c |j}|jdijd}t|tr |j r|j Sd|j dS#t $rYwxYw)a A model-actionable reason from a gateway refusal, or a generic one. The gateway's 4xx bodies carry deliberate guidance (rate-limit waits, size caps, "you could not submit anyway"), so surface `error.message` verbatim rather than a bare status code. errormessagez%the gateway refused the upload (HTTP ))jsonrQrrr r- status_code)responsepayloadrs r_describe_media_upload_refusalrsw --/++gr*..y9 gs # ==? "383G3G2H JJ    sA A33 A?>A?ctsyt|tr|jdsyt tj }|j d|j}||dfd }|S)uAsync ``(data, mime) -> argument value`` uploader for one managed vendor. Returns ``None`` when there is no usable upload endpoint (not a managed Nous URL, or no ``upload_path``); callers then refuse local paths with a clear message instead of silently forwarding them. The three steps of the protocol: 1. POST ``origin + upload_path`` with the declared content type and exact byte length, using the same live auth headers as the vendor calls. The gateway answers with a presigned single-object PUT URL (short expiry; type and length are signed into it) and an upload token. 2. PUT the bytes to that URL. This goes directly to storage — never through the gateway — which is what removes the request-size ceiling. 3. Return ``nous-upload:`` for the tool argument. The token is bound to this Nous principal and is redeemable only through the gateway, so it is inert anywhere else it might end up. Nrvrxc (Kddl}ddlm}t }|s t d|j t }|j|4d{}|j||t|dd{}dddd{jdk7rt t| |j}t|tr|j!dnd} t|tr|j!d nd} t| t"r| rt| t"r| s t d |j t t$t& } || 4d{}|j)| |d |i d{} dddd{ jdk7rt d| jdd| S7s7N7A#1d{7swYRxYw#t$rd}Y/wxYw77t7f#1d{7swYvxYww)Nr)create_ssrf_safe_async_clientz.no Nous credential is available for the upload)timeout) contentType contentLength)headersr uploadUrlrz+the gateway's upload response was malformed)readwritez Content-Type)contentrz!storage refused the upload (HTTP rz nous-upload:)httpxtools.url_safetyrr RuntimeErrorTimeout%_MEDIA_UPLOAD_PRESIGN_TIMEOUT_SECONDS AsyncClientpostlenrrrr-rr+rQr&_MEDIA_UPLOAD_PUT_READ_TIMEOUT_SECONDS'_MEDIA_UPLOAD_PUT_WRITE_TIMEOUT_SECONDSput)datamimerrrpresign_timeoutclientpresignr upload_urlr put_timeoutrr presign_url server_urlrs ruploadz,build_managed_media_uploader..upload,s B.z?LYOP P --(MN$$_$=  "KK%)CIF(G     # %=gFG G llnG2rsO"  '!%,A   8 $1&*-' $O + 0sr j @"MDH:> F  F"@ F7 FCe FDH:>R R"@R7RCGR"! 7;h h3h h07;:>8 83888 84)-%)-&*/'K&7;:> UUU4U8 U  Un$ 7; 3r