+ iHj.Rt^RIt^RIt^RIHtHtHt^RIHtR t RRlt Rt Rt Rt RRltR R lt!R R 4tR#)aProvider API error summarising for ``AIAgent``. Entitlement-failure detection, xAI subscription decoration, structured-detail coercion, and log-safe redaction of provider error payloads. Extracted from ``run_agent.py``; every method resolves through ``AIAgent``'s MRO unchanged. N)AnyDictOptional)redact_sensitive_textc0V^8dQhR\R\/#errorreturn) BaseExceptionbool)formats"1is_provider_stream_parse_error..'s#]?\Vc%j..00?\(+TF) isinstance ValueErrorUnicodeEncodeErrorjsonJSONDecodeErroranyPROVIDER_STREAM_PARSE_MARKERS)r sfris_provider_stream_parse_errorr#$st uj ) ^ ^*UEWY]YmYmDn2o.o ^ ^]?\]__]?\]]_ruZ — xAI rejected this OAuth account. NOTE: X Premium+ does NOT include xAI API access — only standalone SuperGrok subscribers can use this provider. Other possible causes: no Grok subscription, your tier doesn't include this model, or your quota is exhausted. Check https://grok.com/?_s=usage to see which, or run `/model` to switch providers.c0V^8dQhR\R\/#)rrr )rr )r s"rrr>sCDrctRV9;'g-RV9;'dRV9;'gRV9;'dRV9#)zYxAI's permission-denied body text for an unsubscribed / under-tiered / exhausted account.z'do not have an active grok subscriptionzout of available resourcesgrokzdoes not have permission)rs&r_is_xai_entitlement_textr(>sQ 2U: E E (E 1 E Efo E E &% / C CFeOrc0V^8dQhR\R\/#r Exceptionr)r s"rrrGs:: :c:rc<\VRR4pV'dRV R2#R#) status_codeNzHTTP z: )getattr)r r-s& r _http_prefixr0Gs&%5K&1U;-r "9r9rca]tRt^LtoRt]V3RlRl4t]V3RlRl4t]V3RlRl4t]V3RlR l4t V3R lR lt V3R lR lt Rt Vt R#)ApiErrorSummaryMixinz?Provider error -> user/log-safe summary (see module docstring).cb<V^8dQhRS[S[S[S[3,,RS[S[,RS[/#)r error_contextr-r )rdictrrintr )r __classdict__s"rr!ApiErrorSummaryMixin.__annotate__Ps622S#X/2>Fsm2 2rc aVR9dR#\S\4'gR#RPV3RlR44pVP4'gR#RV9gRV9dR#\ V4#)uNDetect subscription/entitlement 401/403s that masquerade as auth failures. Refreshing a token cannot fix an unsubscribed account, so callers surface the error instead of looping the pool. xAI returns the same permission-denied text for BOTH cases; a ``[WKE=unauthenticated:...]`` suffix (or "access token could not be validated") means stale token → return False so the refresh path runs. Disambiguator for xAI (#29344): the same ``code`` text ("The caller does not have permission to execute the specified operation") is returned for BOTH an unsubscribed account AND a stale OAuth access token. xAI ships an explicit signal in the ``error`` field that tells the two apart: a ``[WKE=unauthenticated:...]`` suffix (and/or the ``OAuth2 access token could not be validated`` phrasing) means the credentials failed validation — that's recoverable by refreshing the token, NOT by surfacing an entitlement message. When either signal is present we return False eagerly so the credential-pool refresh path runs, letting long-running TUI sessions recover from stale tokens without an exit/reopen cycle. F c3<"TF7p\SPV4;'gR4P4xK9 R#5i)r.N)rgetr)rkr4s& rr?ApiErrorSummaryMixin._is_entitlement_failure..hs9 =cC !!!$** + 1 1 3 3=cs !AAz[wke=unauthenticated:z*oauth2 access token could not be validated>N)messagereasoncoder )rr5joinstripr()r4r-haystacksf& r_is_entitlement_failure,ApiErrorSummaryMixin._is_entitlement_failureOsm( . .-..88 =c  ~~ "h .2^bj2j'11rc&<V^8dQhRS[RS[/#)rdetailr r)r r7s"rrr8rs 2 2 2 2rc zV'd \VP44'gV#RV9dV#V \ 2#)uAppend a neutral hint when xAI's OAuth surface returns the permission-denied 403. xAI's ``/v1/responses`` uses one body for several causes (no subscription, tier lacks the model, quota exhausted). The least obvious: X Premium+ does NOT include API access — only SuperGrok does. Lead with that, keep the raw text, point at https://grok.com/?_s=usage. Idempotent: a substring unique to the hint marks prior decoration. zX Premium+ does NOT include)r(r_XAI_ENTITLEMENT_HINT)rJs&r_decorate_xai_entitlement_error4ApiErrorSummaryMixin._decorate_xai_entitlement_errorqs;5fllnEEM (F 2M/011rc&<V^8dQhRS[RS[/#)rvaluer )rr)r r7s"rrr8src \V\4'dV#\V\4'd\FFpVP V4p\V\4'gK,VP 4'gKDVu# \F2pW9gK \ PW,4pV'gK0Vu# \P!VRRR7#\V\\34'd=VUu.uFp\ PV4NK ppRPRV44#VfR#\V4# \d\T4u#i;iuupi)zBReturn a display-safe string for structured provider error fields.FT) ensure_ascii sort_keysz; c38"TFq'gK VxK R#5irr')rparts& rr@ApiErrorSummaryMixin._coerce_api_error_detail..s5E>EEc&<V^8dQhRS[RS[/#rr*)r r7s"rrr8s#G\G\IG\#G\rc 4a\V4pVo\4pSe\S4V9dVP\S44\;QJd#V3Rl\ 4F 'gK RM RM!V3Rl\ 44'dR#SP ;'g SPoK\V4'd RVR, 2#\V4pRV9gR V9d\P!R V\P4pV'd VP^4P4MR p\P!R V4pV'dVRR.M.pVPV4V'd2VPR VP^4P4 24RP!V4#\#V4P$R8Xd\'VR,4#\)VRR4p\+V\,4'd\+VP/R4\,4'd"VP/R/4P/R4MVP/R4p V 'd6\0P3V 4p \0P5V V R, 24#\)VRR4p V Ee\)V RR4;'gRP4p V 'd\8P:!V 4p \+V \,4'dV P/R4p \+V \,4'd>V P/R4'd'\'V \V R,4R, 24#V P/R4'd'\'V \V R,4R, 24#\'V V R, 24#\0P5V VR, 24# \6dRp ELi;i \8P<\>3dRp EL!i;i)uExtract a human-readable one-liner from an API error. Cloudflare HTML pages → ````; network/DNS failures (even SDK-wrapped) → offline hint; else truncated str(error). Nc��������������3���Z���<"���T�F ��q\��������S4������P������������������4�������9���x��K"�� ��R�#�5ir���r���)r���r���currents���& r���r���<ApiErrorSummaryMixin._summarize_api_error.<locals>.<genexpr>���s#�����\@[fS\//11@[r���TFzhHermes can't reach the model provider. You may be offline. Check your internet connection and try again.z'Malformed provider streaming response: :Ni,��Nz <!DOCTYPE<htmlz<title[^>]*>([^<]+)z!HTML error page (title not found)z2Cloudflare Ray ID:\s*]*>([^<]+)zRay u — GeminiAPIError:NiNbodyr rAresponsetextr.:NiN) rsetidaddr!_NETWORK_RESOLUTION_MARKERS __cause__ __context__r#r0research IGNORECASEgrouprEappendrDtype__name__rr/rr5r<r2rYrNr+rloadsr r[)r rawseenprefixmtitlerayrbrkmsgrlsnippetpayloaderrrgs& @r_summarize_api_error)ApiErrorSummaryMixin._summarize_api_errorsW%j+0!bk&= HHR[ !s\@[\sss\@[\\\D''>>7+>+>G )% 0 0Nz***:NN...)callablerrlen)selfr^s&&r_mask_api_key_for_logs+ApiErrorSummaryMixin._mask_api_key_for_logssK C==C!5!5& s8r>b'#c"#hZ((rc&<V^8dQhRS[RS[/#)r error_msgr rK)r r7s"rrr8s  c c rc V'gR#VP4PR4'gRV9dR#RPVP44p\ V4^8dVR,R,pV#)zOClean up error messages for user display, removing HTML content and truncating.z Unknown errorzrsZ  &&. !&_2D: mmr