+ iHjRt^RIHt^RIt^RIt^RIt^RIHtRtRRlt RRlt RRR llt Rt R R lt R R ltRRltRRlt]P"3RRlltRRRlltRR/RRlltR#)azNO_PROXY matching shared by the LLM transport (``agent/process_bootstrap.py``) and the gateway platform adapters (``gateway/platforms/base.py``). One matcher so "is this host in NO_PROXY" has one answer everywhere: exact hosts, domain suffixes (``example.com``, ``.example.com``, ``*.example.com``), IP literals, CIDR ranges, optional ``host:port`` entries and ``*``. The stdlib ``proxy_bypass_environment`` understands none of the CIDR / ``*.`` forms, which is why the LLM path used to route ``10.x`` endpoints through the corporate proxy while Telegram/Discord bypassed it. Leaf module: stdlib only, importable during early boot. ) annotationsN)urlsplitcV^8dQhRR/#)returnstr)formats"7/home/ubuntu/.hermes/hermes-agent/agent/proxy_bypass.py __annotate__r s]]s]c8a\V3Rl\4R4#)zMFirst non-empty HTTPS_PROXY / HTTP_PROXY / ALL_PROXY value (any case), or ''.c3<"TFHp\PPV4;'gRP4;o'gKDSxKJ R#5iN)osenvirongetstrip).0kvs& r (first_proxy_env_value..s;WNqRZZ^^A5F5L5L"4S4S4U/Uq/UNs*AA Ar)nextPROXY_ENV_KEYSrs@r first_proxy_env_valuers WNWY[ \\r c V^8dQhRRRR/#)rvaluerrztuple[str, int | None]r)r s"r r r s**3*#9*r cJ\T;'gR4P4pV'gR #RV9gVPR4'd0\V4pVP;'gRpVP pMVPR4'dlRV9deVR,PR4wr5pVPR4'd0VR,P4'd\VR,4MRpMtVPR4^8XdMVPR4^,P4'd!VPR4wr5p\V4pMVPR 4RrCVP4PR 4V3# \ dRpL0i;i) z``(host, port)`` from a URL (scheme optional: ``//host/path``), ``[v6]:port``, ``host:port`` or bare host; host lowercased. A malformed URL port (``host:abc``, ``host:99999``) yields ``(host, None)`` rather than raising.rNz://z//[]:NN:[].r)rr startswithrhostnameport ValueError partitionisdigitintcount rpartitionlowerrstrip)rrawparsedhostr)_restport_ss& r split_host_portr8sI ekkr  "C  |s~~d++#$$" ;;D   B))#.  $ 4 4b9I9I9K9Ks48}QU 31 !4Q!7!?!?!A!A..-6{YYt_dd ::<  s #T )) D s. F F"!F"c V^8dQhRRRR/#)rno_proxy_value str | Nonerz list[str]r)r s"r r r 5sRRZR9Rr cVfRPRR44p\P!RVP44Uu.uFq'gK VNK up#uupi)zqComma/whitespace-separated NO_PROXY entries; from the environment (both casings) when ``no_proxy_value`` is None.,c3b"TF%p\PPVR4xK' R#5ir)rrr)rkeys& r r#no_proxy_entries..9s$!^E]c"**..b"9"9E]s-/z[\s,]+NO_PROXYno_proxy)joinresplitr)r:parts& r no_proxy_entriesrH5sQ!^E]!^^XXi1E1E1GH QHTDDDH QQ Qs  AAc V^8dQhRRRR/#)rr4r;rboolr)r s"r r r GsFF:F$Fr c\T;'gR4P4P4PR4p\V4pVR8H;'gVRJ;'d VP#)zTrue for a host that must always bypass a proxy: ``localhost`` or any loopback IP literal (``127.x.x.x``, ``::1``, ``::ffff:127.0.0.1``).rr% localhostN)rrr0 _ip_or_none is_loopback)r4ips& r is_loopback_hostrPGs] tzzr? " ( ( * 0 0 6D T B ;  E E2T>#D#DbnnEr c V^8dQhRRRR/#rurlrrdictr)r s"r r r OsPPPPr cP\\V4^,4'dRR/#/#)z``websockets.connect`` kwargs for an in-process dial: ``{"proxy": None}`` when ``url`` targets loopback (skip the library's system-proxy auto-detection), else ``{}`` so remote endpoints keep the default proxy behaviour.proxyNrPr8rSs&r loopback_connect_kwargsrYOs'/s/CA/FGGGT?OROr c V^8dQhRRRR/#rRr)r s"r r r Vskkkkr cX\\V4^,4'd RRRRR//#/#)a``requests.get`` kwargs for an in-process HTTP dial (CDP ``/json/version`` discovery / readiness): ``{"proxies": {"http": None, "https": None}}`` when ``url`` targets loopback so ``requests`` skips ``getproxies()`` (env and macOS system proxy), else ``{}``.proxieshttpNhttpsrWrXs&r loopback_request_kwargsr_Vs5:J/Z]J^_`Ja9b9bIgt4 5jhjjr c V^8dQhRRRR/#)renvrTrr)r s"r r r ]s  t  r cra\;QJdV3RlR4F 'gK RM RM!V3RlR44'dS#RFhp\SPV4;'gR4p\Uu.uF q3V9gK VNK ppV'gKNRP W$,4SV&Kj S#uupi)a Append the loopback hosts to ``NO_PROXY`` / ``no_proxy`` in ``env`` (both casings), keeping every operator-provided entry; returns ``env``. An operator ``*`` (bypass everything) already covers loopback and would stop being the wildcard once anything is appended to it.c3r<"TF,pR\SPV4;'gR49xK. R#5i)*rN)rHr)rr?ras& r r(add_loopback_no_proxy..as. [BZ33"3773<#5#526 6BZs"77TFrr=rA)anyrHrLOOPBACK_HOSTSrD)rar?entriesr4missingsf r add_loopback_no_proxyrj]s s [BZ [sss [BZ [[[ '"3773<#5#526$2JND'6I44NJ 7xx 12CH ( JKs 5B4B4cV^8dQhRR/#)rrrr)r s"r r r kssr c8V!V4# \dR#i;i)zR``parse(value)`` or None on ``ValueError`` (``parse`` is ip_address / ip_network).N)r*)rparses&&r rMrMks#U| s  c(V^8dQhRRRRRRRR/#)rentryrr4r)z int | NonerrJr)r s"r r r ss(99#9S9 9d9r c\T;'gR4P4P4pV'gR#VR8XdR#\V4wrEV'dVe VeWR8wdR#\ V4p\ VR4pVeVRJ;'dWg9#VP R4P R4pW8H;'gVP RV 24#)rFrdTNc2\P!VRR7#)F)strict) ipaddress ip_networkrs&r (no_proxy_entry_matches..}s 0D0DQu0Ur r&)rrr0r8rM removeprefixendswith) ror4r)token token_host token_porthost_ipnetworksuffixs &&& r no_proxy_entry_matchesrss    " " $ * * ,E  |,U3J *0dljFX$G*&UVGd"99w'99 $ $S ) 6 6s ;F > 8 8T]]Qvh<88r r:c$V^8dQhRRRRRR/#)r target_hostsz3str | list[str] | tuple[str, ...] | set[str] | Noner:r;rrJr)r s"r r r s) F FE FZd F  Fr c ja\V4oS'd V'gR#\V\4'dV.M \V4p\;QJd;V3Rl\ \ \ \V444F 'gK R# R#!V3Rl\ \ \ \V4444#)zTrue when NO_PROXY (the environment, or ``no_proxy_value``) matches at least one target host (a URL, ``host:port`` or bare host).Fc3<aa"TFNwooS;'d=\;QJd VV3RlS4F 'gK RM RM!VV3RlS44xKP R#5i)c3><"TFp\VSS4xK R#5iN)r)rror4r)s& r r0should_bypass_proxy...sTG5+E4>>GsTFN)rf)rr4r)rhs&@@r r&should_bypass_proxy..sCFDJD$ TTTGTTGTTTDsA AA!AT)rH isinstancerlistrfmapr8)rr: candidatesrhs&$ @r should_bypass_proxyrs ~.G ,#-lC#@#@,drsy # !e] *2R3FPk #,"6"69& Fgk F Fr