߲j4nUdZddlmZddlZddlZddlmZddlmZm Z m Z ddl m Z ejeZdZdZhd Zd d d(d Zd)d d  d*d Zd+dZd+dZeZd,dZdd d-dZd.dZd/dZd0dZ d1 d2dZd3dZd4dZdZ ddiZ!dddZ"dZ#d5d Z$d6d!Z%d7d"Z&iZ'd#e(d$<d8d%Z)d9d&Z*d,d'Z+y):z*Shared helpers for tool backend selection.) annotationsN)Path)AnyDictOptional)is_truthy_valuelocalauto>r directmanagedF force_freshc ddlm}|r |dn|}t|jxr |jS#t $rYywxYw)uCoarse gate: entitled to the Nous Tool Gateway (paid Portal access OR a live free pool). Fails closed on unknown/error — never blocks startup. Callers narrow per category via ``tool_gateway_entitled_for``; ``force_fresh`` is for flows needing a just-bought grant.r)get_nous_portal_account_infoTr F)hermes_cli.nous_accountrbool logged_intool_gateway_entitled Exception)rr account_infos ?/home/ubuntu/.hermes/hermes-agent/tools/tool_backend_helpers.pymanaged_nous_tools_enabledrsNHJU4F9; L**+R 0R0RR s:= A A cj ddlm}m}||||d}|r|S |dS#t$rYwxYw)zHReturn account-aware guidance for an unavailable Nous Tool Gateway path.r)&format_nous_portal_entitlement_messagerr T) capabilityin_chatzY is unavailable. Run `hermes model` to refresh your Nous Portal login and billing status.)rrrr)rrrrmessages r%nous_tool_gateway_unavailable_messagers]   R8 ([ Aj N l4 45    s & 22ctt|xstjj}|xstS)z)Return a normalized browser provider key.)str_DEFAULT_BROWSER_PROVIDERstriplower)valueproviders r normalize_browser_cloud_providerr&0s05556<<>DDFH  000ct|xstjj}|tvr|StS)z=Return the requested modal mode when valid, else the default.)r _DEFAULT_MODAL_MODEr"r#_VALID_MODAL_MODES)r$modes rcoerce_modal_moder,6s8 u++ , 2 2 4 : : A  A )managed_enabledct|}| t}|xr|}|rdnd|rdndd}|j||rdn|rdnd}|||||dk(xr| |dS)zResolve direct vs managed Modal backend: ``direct``/``managed`` are exclusive; ``auto`` prefers managed when available, else direct.Nr r )r r )requested_moder+ has_direct managed_readymanaged_mode_blockedselected_backend)r,rget) modal_moder9r:r6r8 managed_ok exclusiver<s rresolve_modal_backend_staterAKs 'z2N46 2]J)3I'18t=I }}Z XQUW,nT^*$2i$?$WDW 0 22r'c ddlm}||dxsdjS#t$r+t j |dxsdjcYSwxYw)zRead a credential env var under the active profile secret scope; raw env fallback only if ``agent.secret_scope`` cannot import (a packaging edge must never lose the key).r) get_secret)agent.secret_scoperCr"rosgetenv)namerCs rr0r0^sS314$*1133 3 $#)r00223s #1AAct ddlm}t||xsdjS#t$rYywxYw)zQ``.env`` value via ``hermes_cli.config.get_env_value`` (``""`` when unavailable).r) get_env_valuerD)hermes_cli.configrJr r"r)env_varrJs r _dotenv_valuerMhs:3=)/R06688 s (+ 77cL|sy ddlm}||d|S#t$rYywxYw)a``hermes auth remove `` records ``env:`` in ``suppressed_sources`` and promises the variable is ignored until ``hermes auth add``; a value still living in a long-running gateway's process environment (inherited across update restarts) must honor that too.Fr)is_source_suppressedzenv:)hermes_cli.authrOr) provider_idrLrOs r_env_source_suppressedrRqs8 8#K4y1ABB s  ##ct|xsdj}|r|St||}|st|x}r|S ddlm}|ry |s0|r#t||xsdjn t|}|s|s|S ddlm }|d|fD]k}||} | | jr| jnd} tt| ddxst| ddxsdj}|si|cS y#t $rYwxYw#t $r"} tjd ||| Yd} ~ yd} ~ wwxYw) uResolve a voice-provider API key (single owner for STT/TTS lookup). Order: explicit ``config_value`` -> profile secret scope / env -> ``.env`` via ``env_getter`` (or ``hermes_cli.config.get_env_value``) -> credential pool for ``provider_id``. Under an active multiplex turn the profile scope is authoritative: a miss returns ``""`` rather than borrowing another profile's env or pool. Never raises. The env/.env tier is skipped entirely while ``env:`` is suppressed for ``provider_id`` (#116155). Resolution order (fixes #68003 — keys added via ``hermes auth add `` were invisible to the voice tools, which only consulted env/.env): rDr)is_multiplex_active) load_poolzcustom:Nruntime_api_key access_tokenz,Could not read %s credential pool for %s: %s)r r"rRr0rErTrrMagent.credential_poolrUhas_credentialspeekgetattrloggerdebug) rLrQ config_value env_getterkeyenv_suppressedrTrUpool_keypoolentryexcs rresolve_provider_secretrf~sh l b ! ' ' )C  +KAN &8&AAsA  :   ! 8Bc*W%+,224 V]H^ +  `3$ }&=> HX&D#'#38L8L8NDIIKTXEge%6;wun^`?a"UW    %    ` C[RY[^__ `s7 DA5D>DD DD D?D::D?c6tddxs tddS)uPrefer VOICE_TOOLS_OPENAI_KEY, else OPENAI_API_KEY (scope-aware, pool fallback for the latter). Must go through the secret scope: a raw ``os.environ`` read could bill another profile's account under multiplex. Outside a multiplexed turn, ``OPENAI_API_KEY`` additionally falls back to the credential pool (``hermes auth add openai-api``) via ``resolve_provider_secret`` — same #68003 fix as the other voice providers. The dedicated voice-tools override remains env/scope-only. VOICE_TOOLS_OPENAI_KEYrDOPENAI_API_KEYz openai-api)rfr4r'rresolve_openai_audio_api_keyrjs& $$.use_gateway`` is set in config.yaml. Never raises.r) load_config use_gatewayF)rKrlr= isinstancedictrr)config_sectionrlsections rprefers_gatewayrrsS1=&B++N;'4(X_W[[=W-XX sA A AAnousweb)search_backendextract_backend)cloud_provider)backend)browserrt)r%rxrwc ddlm}|xsi}t|tr|j |nd}t|tr|SdS#t $rYywxYw)z@The RAW (unmerged) config.yaml mapping for ``section``, or None.r)read_raw_config_readonlyN)rKr{rnror=r)rqr{cfgraws r _raw_sectionr~sV>&(.B",S$"7cgggT d+s55 sAA A AAc<t|}|yt|jdrtStj|t D]Q}|j|6t |j|jjnd}|sO|cSy)aTHE single runtime read of the persisted `hermes tools` selection: ``"nous"`` (managed gateway row), a vendor name (direct, own credentials), or ``None`` (never configured -> legacy autodetect allowed). Reads the RAW config.yaml so key presence means "actually written", not "schema default"; a raw ``local`` is therefore a real user selection. Legacy shim: ``use_gateway: true`` was only ever written by the managed row, so it maps to ``"nous"`` regardless of the name key. Never raises.NrmrD) r~rr=NOUS_MANAGED_PROVIDER_SELECTION_NAME_KEYS_DEFAULT_NAME_KEYSr r"r#)rqr}r`texts rread_selectionrs w C {sww}-.$$#''1CD47GGCL4Ls3773< &&(..0RT K r'ct|ytj|d}|r t|ndduxrt fd|DS)zTrue when ANY selection signal was ever written for the section (wider than read_selection: per-capability web keys count too).NTr4c3vK|]0}tj|xsdj2ywrDN)r r=r").0r`r}s r z#selection_exists..s,"Ts3swws|'9r#:#@#@#B"Ts69)r_EXTRA_SELECTION_KEYSr=r~any)rqextrar}s @rselection_existsrsMg* ! % %gr 2E#(,w dC d? Ts"Te"TTTr'zDict[str, Dict[str, str]]REMOVED_BACKENDSctj|ij|xsdjjdjS)zExplanation for a backend that used to ship in-tree, or None. ``name`` tolerates the quoted form callers pass to selection_error().rDz'")rr=r"r#)rqrHs rremoved_backend_notersC    , 0 0$*"1C1C1E1K1KE1R1X1X1Z [[r'c8t||xs|}|d|d|dS)zEThe uniform honest-error contract for a selected-but-broken provider.z is configured to use z (set via hermes tools), but z". Run 'hermes tools' to change it.)r)rqselection_namefailures rselection_errorr s9"7N;FwGi-n-=>")#E GHr'cDttdxs tdS)zTrue when FAL_KEY is set (scope/env, else ``.env`` for CLI paths that run before dotenv loads) to a non-whitespace value, so tool-side and CLI setup-time checks agree.FAL_KEY)rr0rMr4r'rfal_key_is_configuredrs "9-Iy1I JJr')rrreturnr)zthe Nous Tool Gateway)rr rrrr )r$ object | Nonerr )rr) r>rr9rr:rr6z bool | NonerzDict[str, Any])rHr rr )rLr rr )rQr rLr rrr)rLr rQr r^r rr )rr )rpr rr)rqr rzDict[str, Any] | None)rqr rz str | None)rqr rr)rqr rHr rz Optional[str])rqr rr rr rr ),__doc__ __future__rloggingrFpathlibrtypingrrrutilsr getLogger__name__r\r!r)r*rrr&r,normalize_modal_moder5rAr0rMrRrfrjrrrrrrr~rrr__annotations__rrrr4r'rrs-0" &&!   8 $#27< 5>C57;5HK5"1 G ) @D2/321<2HV2&3 QS'+(03(V H EF$7|L>*U/1+0\ HKr'