+ iHjwRt^RIHt^RIt^RIt^RIt^RIHt^RIH t H t H t ^RI H t Rt^t0Rmt^tRRltR R ltR R ltR RltRRRRRR/RRlltRRltR#)a|``$HERMES_HOME/cache//`` materialisation helpers for the image/video generation provider ABCs. Several backends return *ephemeral* delivery URLs that expire before a downstream consumer (Telegram ``send_photo``, browser fetch) can resolve them, so providers materialise the bytes locally at tool-completion time. Filenames are ``__.``. ) annotationsN)Path)DictOptionalTuple)urljoin generatedc V^8dQhRRRR/#)kindstrreturnr)formats"9/home/ubuntu/.hermes/hermes-agent/agent/provider_media.py __annotate__rsCDcb^RIHpV!4R, V, pVPRRR7V#)zBReturn ``$HERMES_HOME/cache//``, creating parents as needed.)get_hermes_homecacheT)parentsexist_ok)hermes_constantsrmkdir)r rpaths& r cache_dirrs,0  w & -DJJtdJ+ Krc(V^8dQhRRRRRRRR/#)r r r prefix extensionr rr)rs"rrr's.BBSB#B#B$Brc\PP4PR4p\P!4P R,p\ V4V RV RV RV 2, #)z %Y%m%d_%H%M%S:NN_.)datetimenowstrftimeuuiduuid4hexr)r rrtsshorts&&& r cache_pathr+'s]      ) )/ :B JJL  R E T?xqAeWAi[A AArc ,V^8dQhRRRRRRRRRR/#) r r r rawbytesrrr rr)rs"rrr-s/Surc@\WV4pVPV4V#)z:Write raw bytes to the cache and return the absolute path.)r+ write_bytes)r r-rrrs&&$$ r save_bytesr1-s! dI .DS Krc ,V^8dQhRRRRRRRRRR/#)r r r b64_datarrr rr)rs"rrr4s6\\3\#\#\#\$\rcF\V\P!V4W#R7#)z?Decode base64 data into the cache and return the absolute path.)rr)r1base64 b64decode)r r3rrs&&$$rsave_b64r74s dF,,X6v [[rheadersrequire_known_content_typeFtrusted_origincTV^8dQhRRRRRRRRRRR RR R R R RRRRRRRRRRRRRR/#)r r r urlrtimeoutfloat max_bytesint chunk_size content_typeszdict[str, str]url_extensionsztuple[str, ...]default_extensionlabel empty_errorr8zOptional[dict[str, str]]r9boolr:r rr)rs"rrr9sT^T^ T^T^$'T^27T^DGT^UXT^!T^3BT^WZT^ T^!T^,DT^!% T^?C T^  T^rc a^RIp^RIHpHpHpYT ppp\ \ ^,4EFpV'd3V!V4'd\V RV 24hVPVRR7pM(V!V4'g\V RV 24hV!VRR7pT;_uu_4VPRVVR7;_uu_4pVP\9dWVPPR 4pV'g\V R V 24h\VV4RRpppRRR4RRR4KVP'g!VP!4VP#4VPPR 4;'gR P%R ^4^,P'4P)4pVPV4pV 'dVf\T RT;'gR 24hVf>VP%R^4^,P)4o\+V3RlV4V4p\-WV4p^pVP/R4;_uu_4pVP1VR7FmpV'gK V\3V4, pVV8d7VP54\7V4\V RV RVR, R24hVP9V4Ko RRR4V^8Xd'\7V4\V P;VR74hVuuRRR4uuRRR4u# \V R\ RV 24h +'giLn;i +'giM;iRRR4EK> +'giEKP;i)u9Stream-download *url* into the cache with a size cap. The extension comes from the response ``Content-Type`` (an explicit table — never inherit a type pointing at HTML/JSON from a degenerate response), then the URL suffix (some CDNs return ``application/octet-stream``), then *default_extension*. Raises on any network / HTTP / oversize / empty error so callers can fall back to the bare URL; a partial file is never left behind. The URL is provider-supplied, so every hop is validated with ``tools.url_safety`` before a socket opens (and again at TCP connect by the guarded transport, closing DNS-rebinding TOCTOU). Caller-supplied *headers* (e.g. provider auth) go to the first hop only — a redirect target never receives them. *trusted_origin* is for callers that built *url* from the operator's own provider ``base_url`` (not from a provider response): the first hop skips the private-address class check so a LAN/loopback relay works without ``security.allow_private_urls``, but the cloud-metadata floor still applies and every redirect target is re-validated in full. N)create_ssrf_safe_clientis_always_blocked_url is_safe_urlz( URL targets an always-blocked address: F)r=follow_redirectsz# URL failed the SSRF safety check: GET)r8locationz) download redirected without a Location: z Content-Type;z+ download returned unexpected Content-Type z (missing)?c3r<"TF,pSPRV 24'gKVR8XdRMTxK. R#5i)r"jpegjpgN)endswith).0exturl_paths& r save_url..vs7sNSV^VgVgjklokphqVr8#-S8Ns77wb)rAz at z exceeds zMB cap; refusing to cache.)r<z download exceeded z redirects: i)httpxtools.url_safetyrIrJrKrange_MAX_SAVE_URL_REDIRECTS ValueErrorClientstream status_code_REDIRECT_STATUS_CODESr8getr is_successreadraise_for_statussplitstriplowernextr+open iter_byteslenclose _unlink_quietwriter) r r<rr=r?rArBrCrDrErFr8r9r:r\rIrJrK current_url hop_headers trusted_hopr!clientresponserN content_typerr bytes_writtenfhchunkrXs &&$$$$$$$$$$$$ @rsave_urlr|9s$4\\,/.kK *Q. / $[11 E7*RS^R_!`aa\\'E\JF{++ E7*Mk]![\\,WuUF Vuk;GG8''+AA'//33J?H#(E72[\g[h)ijj-./34)__doc__ __future__rr5r#r&pathlibrtypingrrr urllib.parserGENERATED_SUBDIRMEDIA_CACHE_MAX_AGE_HOURSrdr_rr+r1r7r|rqrrrrs#  (( 2B \ T^GKT^(- T^FK T^n r