߲j@dZddlmZddlZddlmZddlmZmZm Z eje Z gdZ dZehdZed Gd d Zdd ZddZddZ d ddZddZddZy)zConfiguration and availability gate for connector tools. Availability fails closed; the gateway remains authoritative for entitlement and route availability. ) annotationsN) dataclass)AnyCallableOptional)MAX_CALLS_PER_DISPATCHConnectorConfigconnectors_available load_config >0noofffalseT)frozenc.eZdZUdZded<eddZy)r Tboolenabledct|tr ||St|tr"|t|j ddS|S)z:Malformed configuration falls back to the enabled default.)rrT) isinstancerdict _coerce_boolget)clsraws D/home/ubuntu/.hermes/hermes-agent/tools/connectors/gateway/config.pyfrom_rawzConnectorConfig.from_raw sE c4 s# # c4 |CGGI,>EF Fu N)rrreturnz'ConnectorConfig')__name__ __module__ __qualname__r__annotations__ classmethodrrrr r s GTrr ct|tr|S||St|ttfr t|St|tr$|j j tvS|S)N)rrintfloatstrstriplower_FALSE_STRINGS)valuefallbacks rrr*s\%  }%#u&E{%{{}""$N:: Orcx ddlm}|xsi}t|jdtr|jdni}t|tsi}t j |jdS#t$r5}tjd|t j dcYd}~Sd}~wwxYw)Nr)load_config_readonlytools connectorsz#Failed to load connector config: %s) hermes_cli.configr1rrrr r Exceptionloggerdebug)_loadcfg tools_cfges rr r 6s .Cgm(237773CT(JCGGG$PR )T*I'' l(CDD . :A>''--.sA8A;; B9*B4.B94B9cbddlm}|}t|jxr |jS)aThe portal has enabled connectors for this account. The gateway answers 404 to every ``/v1/connectors`` route for an account the portal has not enabled, and 404 is indistinguishable from "dark" by design. Paid access or a free tool pool says nothing about that, so entitlement is the wrong predicate here: the portal mints its answer onto the token as ``managed_tools`` and this reads only that. A token minted before the claim existed carries none and reads as not enabled.r)get_nous_portal_account_info)hermes_cli.nous_accountr=r logged_inmanaged_tools_rolled_out)r= account_infos rr@r@Ds,E/1L  && ' QL,Q,QQrc |xst}|jsy| ddlm}ddlm}||ryt }t|S#t$r }tjd|Yd}~yd}~wwxYw)aFail closed so availability failures do not become model-visible errors. The one gate for the connectors surface, and the tool's ``check_fn``: outside it the tool is not in the schema at all, so the model never narrates a gateway 404 to a user the portal has not enabled. Free-tier identities are always in; accounts are in only when the portal says so via the token claim.FNr)is_guest_state)_read_nous_provider_stateTz'Connector availability check failed: %s) r rhermes_cli.anon_authrCtools.managed_tool_gatewayrDr@rr5r6r7) config_loaderentitlement_checkresolved_loaderrCrDr;s rr r Rst'6; ((  $ ; L79: 8 %'((  >Bs!AAA A9A44A9cBddlm}|ddxst|xsdS)a^The key an operation is registered under: the gateway session key the RPCs look up by (``HERMES_SESSION_KEY``), falling back to the agent's session id where no gateway bound one. The agent id alone is wrong on the desktop: compaction rotates it mid-turn while the gateway key stays, and a card keyed by the old id can no longer be driven.rget_session_envHERMES_SESSION_KEYr )gateway.session_contextrLr*) session_idrLs roperation_session_keyrPos$ 8 / 4 MJr^s #!**   8 $ :; $     . R>B6::3 :N/r