߲j5 dZddlZejdZdddddZd efd Zd ed efd Zd efd Z dededede d e f dZ de d efdZ dededed efdZy)aOne-shot keyless-ring rescue for failed keyed/configured web calls. Stateless by design: a rescue routes THIS call through the free-tier ring (plugins/web/keyless_mcp.py); the next web_search/web_extract call attempts the chosen backend again. Callers must never cache a rescue-served response, or the one-shot rescue becomes sticky for a whole TTL. Logs under the origin (tools.web_tools) logger. Nztools.web_tools EXA_API_KEYPARALLEL_API_KEYFIRECRAWL_API_KEYKEENABLE_API_KEY)exaparallel firecrawlkeenablereturncddlm}|jddsy ddlm}|S#t $r }t jd|Yd}~yd}~wwxYw) zV``web.keyless_rescue`` (default on), implicitly off when the keyless tier is disabled.r)_load_web_configkeyless_rescueTF)_keyless_tier_enabledz$keyless rescue tier check failed: %sN)tools.web_toolsr getagent.web_search_registryr Exceptionloggerdebug)r rexcs ;/home/ubuntu/.hermes/hermes-agent/tools/web_tools_rescue.py_keyless_rescue_enabledrsO0   ! !"2D 9C$&&  ;SAs - AAAnamec|dk(r ddlm}|Sddlm}ddlm}t j|d}|||r ||SdS)uDid *name*'s own provider route this call through the anonymous keyless ring? Mirrors the predicate each ring provider evaluates before calling, so eligibility reflects what actually happened. Firecrawl owns extra routes that bypass the ring without a key — the managed Nous Tool Gateway (persisted ``nous`` selection, or the legacy never-configured fallback when the gateway is ready) and a self-hosted ``FIRECRAWL_API_URL`` — so it is asked directly. r r)_use_keyless_ring)get_provider_env) use_keyless)plugins.web.firecrawl.providerragent.web_search_providerrplugins.web.keyless_mcpr_RING_KEY_VARSr)rrrrkey_vars r_ring_vendor_keylessr$!sM {D "":3  r*G t'-g6 JJr JJctr|y ddlm}t|dd}||vxs t | S#t $r }t jd|Yd}~yd}~wwxYw)usTrue when a failed call on *provider* should get a one-shot rescue. Eligible: any call that did NOT go through the keyless ring — a non-ring backend, a ring vendor in keyed mode, or a ring vendor routed through the managed gateway / a self-hosted instance. A ring vendor that walked the ring is NOT eligible: its failure means the ring already failed. NFr) _KEYLESS_RINGrrz#rescue eligibility check failed: %s)rr!r'getattrr$rrr)providerr'rrs r_rescue_eligibler*2sc # $(89x,=(J0DT0J,JJ  :C@s$4 AAA provider_nameoriginal_errorquerylimitc *ddlm}tjd||xsddd||||}|j dr6|j dij |d |d |xsd dd d |d|Sd|xsdd|j ddddS)zSRescue a failed search via the ring; annotate the result with the original failure.r)search_with_failoverzDs< NNF,"ds3#=%?G{{962&--&&}o6#6=>?++8/C . 012,,3KK,K+LA O r%resultct|jdxsdj}t|jdxsd|vS)ubTrue for a website-policy refusal — intentional, never rescued (it would fetch blocked content).r7rblocked_by_policyzblocked by website policy)strrlowerbool)r?r7s r_policy_blocked_resultrE`sD  7#)r * 0 0 2E  ./ 0 X4OSX4XXr%urlsresultsc$ddlm}tt|k(}tDcgc]\}}|r t |r|}}}|sS|r|Dcgc]}|| c}n t |}fd|D} t | d} tjd|t|| xsddd||t |} | rtd | DrS| D]I}|jd rdn|jd i} t| ts9|| d <| xsddd | d<K|rZt| t|k(rCtt|| } tDcgc]\}}| j||c}}S| Scc}}wcc}wcc}}w)aRescue a whole-batch extract failure via the ring. Only genuine failures are re-fetched; policy-blocked entries are preserved verbatim. If the provider broke url/result order parity, every entry is treated as rescueable and the ring's list replaces the batch wholesale. r)extract_with_failoverc3pK|]-}|jds|jd/yw)r7Nr).0irGs r z"_rescue_extract..us- U!WQZ^^G=TgajnnW% Us66zextract failedzKweb_extract backend '%s' failed all %d URL(s) (%s); one-shot keyless rescuerNr1c3@K|]}|jddyw)r7rNrK)rLrs rrNz"_rescue_extract..|s;aquuWb);sr7metadatar5r4r6)r!rIlen enumeraterElistnextrr:allrr; isinstancedictzip)r+rFrGrIparityrMrP rescue_idx rescue_urlserrorsr,r=meta replacementss ` r_rescue_extractr`fs> \SY &F )' 2b1&H^_`Ha!bJb 39J/q47/tDzK Uz UF&"23N NNUs;'.*>B)E$M4 3DEG3;7;; AuuW~t1<< B+G dD !#0D %3%9r4C$@D ! A #g,#j/1C G45 3rErTr`r%rrfs   , - &8$2D  KsKtK"$$#s3sW[8Y4YDY 3 d T d r%