߲j-)dZddlmZddlZddlZddlZddlZddlmZm Z m Z dZ dZ dZ ddZdd Zdd Zdd Zhd Zhd ZddZddZddZ d dZd!dZd"dZddZddZdddd d#dZy)$z0Shared helpers for direct xAI HTTP integrations.) annotationsN)AnyDictOptionalzhttps://api.x.ai/v1i'icHt|tr|j|SdSN) isinstancedictget)objkeys 3/home/ubuntu/.hermes/hermes-agent/tools/xai_http.py _dict_getrs%c403773<:d:cddlm}|ddxsdjry ddlm}|dz }|j syt j|jd }ttt|d d d }tt|dxsdjrytt|dd }t|txrtd|DS#t$rYywxYw)uYCheap probe: True when xAI credentials are *likely* usable. Deliberately avoids :func:`resolve_xai_http_credentials` (disk locks, OAuth network refresh) — hot-paint callers and ``WebSearchProvider.is_available()`` must not do network I/O. Checks, fast-to-slow: ``XAI_API_KEY``; ``providers.xai-oauth.tokens.access_token`` in ``auth.json``; any ``credential_pool.xai-oauth`` entry with an ``access_token`` (pool-only multi-account grants never write the providers singleton). Returns False on any exception so a corrupted auth store can't block other availability scans. r) get_secret XAI_API_KEYTget_hermes_homez auth.jsonFz utf-8-sigencoding providers xai-oauthtokens access_tokencredential_poolc3K|]C}t|txr-t|jddxsdj Eyw)rrN)r r strr strip).0es r z&has_xai_credentials..-sB1 UVJq$  PCnb(A(GR$H$N$N$P P1 sA A )agent.secret_scoperr hermes_constantsrexistsjsonloads read_textrrr listany Exception)rr auth_pathstorerentriess rhas_xai_credentialsr0s.="%+2244#% 3 ! 9.. .DE9Yuk%BKPRZ[ y06B 7 = = ?Ie->?M'4( S1 Za1 .   s C,A,C,29C,, C87C8c< ddlm}d|S#t$rd}YwxYw)z>Return a stable Hermes-specific User-Agent for xAI HTTP calls.r __version__unknownz Hermes-Agent/) hermes_clir3r,r2s rhermes_xai_user_agentr64s/ *;- ((    s  cdtiS)zaDefault headers for OpenAI-SDK and raw HTTP clients talking to xAI (replaces the SDK User-Agent).z User-Agent)r6rrhermes_xai_default_headersr9=s /1 22r>1onyestrueenabled>0noofffalsedisabledct|tr|St|tr5|jj x}t t zvr|t vS|Sr)r boolrr lower _TRUE_WORDS _FALSE_WORDS)valuedefault normalizeds r _coerce_boolrLFsL% %1D1D1F#F:;YeKe"e[(( Nrc:|yt|tr/|jj}|dvry t |}t|ttfst St |dkrdStt |tS#t $r t cYSwxYw)z\Normalize an xAI storage TTL: int seconds, or None for permanent storage (omit on the wire).N>rr?nonenullneverrJforever permanentr) r rr rFint ValueError&SAFE_XAI_STORAGE_EXPIRES_AFTER_SECONDSfloatmin%MAX_XAI_STORAGE_EXPIRES_AFTER_SECONDS)rIs r_coerce_expires_afterrYNs }% ##% Y Y :JE ec5\ *55u:?4^CJ8](^^  :9 9 :s BBBcD ddlm}ttt||dd}t |t r|ni}t |jddt |jddt|jd d S#t$rd}YqwxYw) zRead ``.xai.storage`` (``image_gen``/``video_gen``) -> {enabled, public_url, expires_after}. On by default so xAI returns permanent public URLs, not short-lived CDN ones; null TTL = permanent.r) load_configxaistorageNr>T public_url expires_after)r>r^r_) hermes_cli.configr[rr,r r rLr rY) section_namer[r]s rread_xai_imagine_storage_configrb_s1Ii |&LeTV_`$GT2gG I 6="7;;|#Nz %Y%m%d-%H%M%S-.binr^)filenamer^r_) rbdatetimenowUTCstrftimeuuiduuid4hexlstriprE)rafilename_prefix extensioncfgtsrhpayloads rbuild_xai_storage_optionsrvos *, 7C y>     x|| , 5 5o FB!"!B4q)9)9"1)=(>a @P@PQT@U@^Y^?_`H+34LHYCZ[G ?'#&#7 Nrctt|}|dsyd}|d|ddz }d|dd|d k7rd nd}d |d |d S)z5User-facing notice for first xAI Imagine storage use.r>rzwithout an automatic expiryr_iQz for about gz dayszMxAI Imagine storage is enabled so generated media gets a reusable public URL zK. xAI may bill for stored files and public URL hosting. Disable this with `zL.xai.storage.enabled: false` or set `expires_after` to change the retention.)rb)rars retentiondayss rxai_storage_notice_textr}~su ), 7C y>-I ?'?#|4 aDAIS2,FG  [!''3n5: :rc\t|}|sy ddlm}|dz }|jdd||dz }|j ry|j t j jt jjdzd |S#t$r|cYSwxYw) zBReturn the storage notice once per Hermes home, then mark it seen.NrrstateT)parentsexist_ok_xai_storage_notice_seen zutf-8r) r}r%rmkdirr& write_textrirjrk isoformatr,)ranoticer marker_dirmarkers r"maybe_mark_xai_storage_notice_seenrs $\ 2F  4$&0 5.FGG ==?(++// =GGIDP[bc  s;B AB B+*B+c ddlm}|ddS)u$Read ``XAI_API_KEY`` via ``resolve_provider_secret`` (config → profile scope → env/.env → pool). Both the preferred-key and the no-OAuth fallback paths go through here so scope policy (incl. failing closed in a multiplexed gateway turn) is never re-implemented per caller. rresolve_provider_secretrr\)tools.tool_backend_helpersrrs r_resolve_explicit_xai_api_keyrs C "=% 88rcddlm}t|dxs |dxsdjj dS)zG``HERMES_XAI_BASE_URL`` then ``XAI_BASE_URL``, stripped; '' when unset.r get_env_valueHERMES_XAI_BASE_URL XAI_BASE_URLr/)r`rrr rstriprs r_xai_base_url_overriders;/ }23Z}^7TZXZ [ a a c j jkn oorF) force_refresh api_key_hintprefer_api_keyclddlm}|rNttxsdj x}r't }|j |t}d||dS ddlm }|d}|r|j|n|j} |r| |j} t| d dxs t| d d} tt| d dxst| d dxs |jj jd } |j t | }t| j rdt| j |dS ddlm} t} t| dxstj jd }d| |dS#t$rYWwxYw)uResolve bearer credentials for direct xAI HTTP endpoints. Default order: Hermes-managed xAI OAuth, then ``XAI_API_KEY`` (via ``get_env_value`` so ``~/.hermes/.env`` keys count). ``prefer_api_key=True`` inverts that for API-metered endpoints where the subscription OAuth bearer authorizes but misbehaves (x_search answers without citations, TTS 403s). Both branches honor ``HERMES_XAI_BASE_URL``/``XAI_BASE_URL`` behind the same origin-pinning validation. ``force_refresh=True`` forces an OAuth refresh; pass the rejected bearer as ``api_key_hint`` so a multi-account pool refreshes the issuing entry, not whichever its strategy selects first. Prefers Hermes-managed xAI OAuth credentials when available, then falls back to ``XAI_API_KEY`` resolved via ``hermes_cli.config.get_env_value`` so keys stored in ``~/.hermes/.env`` (the standard Hermes location) are honored — not just ones already exported into ``os.environ``. This keeps direct xAI endpoints (images, TTS, STT, etc.) aligned with the main runtime auth model and preserves the regression contract from PR #17140 / #17163. The key is read through :func:`tools.tool_backend_helpers.resolve_provider_secret` so profile secret scoping is identical to the fallback branch, and the base URL honors ``HERMES_XAI_BASE_URL`` / ``XAI_BASE_URL`` behind the same origin-pinning validation as the OAuth branch. See #87045, #88040. rNr)fallbackr\)providerapi_keybase_url) load_poolrruntime_api_keyrruntime_base_urlrrrr)hermes_cli.authauthrrr r _xai_validate_inference_base_urlDEFAULT_XAI_BASE_URLagent.credential_poolrtry_refresh_matchingselectgetattrDEFAULT_XAI_OAUTH_BASE_URLrr,r`r)rrrauth_mod explicit_keyoverriderrpoolentryrfallback_base_urlrrs rresolve_xai_http_credentialsrs,'3/L/N/TRT+U+[+[+]]<])+<d'%Q_acBd  E-t 4 3uj"- 322  %'&&+  <<=S=U`q<r |  " " $ +L8I8O8O8Q_gh h % 0+-G=0H4HIOOQXXY\]H'x HH    sDF'' F32F3)r rr rreturnr)rrE)rr)rDict[str, str])rIrrJrErrE)rIrrz Optional[int])rarrzDict[str, Any])rarrqrrrrrzOptional[Dict[str, Any]])rarrr)rarr Optional[str])rrErrrrErr)__doc__ __future__rrir'osrmtypingrrrrrXrUrr0r6r9rGrHrLrYrbrvr}rrrrr8rrrs6" &&-(9%)9&;>)3 4 6 _"   +. ;>  "$9p#$_d4I4I2?4IX\4I4Ir