+ lHj dRt^RIHt^RIt^RIt^RIt^RIHt^RIH t H t ^RI H t ^RI Ht]P!]4tRtRt^xt]!R R 7!R R 44tR RltRtRRltRRltRRltRRltR&RRlltRRltRRltRRltR'R R!llt R(R"R#llt!R'R$R%llt"R#))zIGeneric managed-tool gateway helpers for Nous-hosted vendor passthroughs.) annotationsN) dataclass)CallableOptionalget_hermes_home)managed_nous_tools_enabledznousresearch.comhttpsT)frozenc@]tRt^t$R]R&R]R&R]R&R]R&RtR#) ManagedToolGatewayConfigstrvendorgateway_originnous_user_tokenbool managed_modeN)__name__ __module__ __qualname____firstlineno____annotations____static_attributes__r?/home/ubuntu/.hermes/hermes-agent/tools/managed_tool_gateway.pyr r s Krr c V^8dQhRRRR/#)valueobjectreturn Optional[str]r)formats"r __annotate__r#sOO&O]Orc~\V\4'd'VP4'dVP4#R#)z:*value* stripped when it is a non-blank string, else None.N) isinstancer strip)rs&r_cleanr's)&uc22u{{}}5;;=N$Nrc$\4R, #)zDReturn the Hermes auth store path, respecting HERMES_HOME overrides.z auth.jsonrrrrauth_json_pathr)"s  { **rcV^8dQhRR/#)rr zOptional[dict]r)r"s"rr#r#'s>rc^RIHpV!R4p\V\4'gR#^RIHpHpV!V4'dV!4'gR#V# \dR#i;i)a<The profile's Nous state, or None. A free-tier identity counts only while guests are allowed: with ``nous.guest: false`` it is invisible here, so no cached or refreshed token of it is ever attached to a request. Resolves through the same profile-then-global-root fallback every other credential reader uses: a profile created with ``share_auth`` has no ``auth.json`` of its own and signs in with the root identity. Reading only ``HERMES_HOME/auth.json`` made that profile look signed out to the connector gate alone, so ``manage_connections`` vanished from its tool list.)get_provider_auth_statenousN) guest_allowedis_guest_state)hermes_cli.authr,r%dicthermes_cli.anon_authr.r/ Exception)r, nous_providerr.r/s r_read_nous_provider_stater5'sS ;/7 -..F - ( ( s!$AA A A AAcV^8dQhRR/#rr r!r)r"s"rr#r#?s  = rc^RIHpHpV!R4p\ V4# Td\P!R4pL*i;i)aHRead the TOOL_GATEWAY_USER_TOKEN override through the secret scope. Scope verdict is authoritative when installed (a scoped miss must NOT borrow the process env under multiplex); ``os.environ`` only when unscoped. Any non-UnscopedSecretError failure propagates -- a failed scoped read must never silently borrow the ambient env.)UnscopedSecretError get_secretTOOL_GATEWAY_USER_TOKEN)agent.secret_scoper9r:osgetenvr')r9r:explicits r_read_user_token_overrider@?sE C878 (  899678s ==cV^8dQhRR/#r7r)r"s"rr#r#Msee ercd^RIHp\4;'g\V!\ 444#)uCheap token probe: env override or cached auth-store token, no expiry check and no network — availability scans must stay off the synchronous OAuth refresh path (:func:`read_nous_access_token`).held_connectors_token)r2rDr@r'r5rCs rpeek_nous_access_tokenrEMs'; $ & d d&1FG`Gb1c*ddrcV^8dQhRR/#r7r)r"s"rr#r#Us rc\4;p'dV#\4;'g/pV'gR#^RIHp\ V!V\ R74;p'dV#\ 4p^RIHp\ V!\ R74;p'dV#V# \dgp^RIH p\Yx4'd/\T\TP;'gR44uRp?#\P!RT4Rp?T#Rp?ii;i) aRead a Nous Subscriber OAuth access token from auth store or env override. A read: with no Nous identity there is no bearer and the answer is None. The free-tier identity is created by the boot bootstrap or the first hosted connector action, never on a token-read path (NS-845 Q1.2). A retired free-tier credential IS replaced here, once: that is the explicit dead-credential rule, shared with inference. NrC) skew_secondsresolve_nous_access_tokenrefresh_skew_seconds)AnonCredentialDeadanon_credential_deadz$Nous access token refresh failed: %s)r@r5r2rDr''_NOUS_ACCESS_TOKEN_REFRESH_SKEW_SECONDSrEr0rJr3rMr%_replace_dead_guest_tokenr codeloggerdebug) r?r4rD fresh_token cached_tokenrJrefreshed_tokenexcrMs rread_nous_access_tokenrXUs-..x.-/552M :2=Ovwxx{x)+L B=$%>T{%|} }? }" " ~  B < c . .,]C@b@bLbhttpr )r=r>r&lower_DEFAULT_TOOL_GATEWAY_SCHEME ValueError)schemes rget_tool_gateway_schemerlsH YY,b 1 7 7 9 ? ? A a aEaF &&HII Mrc V^8dQhRRRR/#)rrr r r)r"s"rr#r#sMMSMSMrch\P!VP4PRR4 R2R4P 4P R4;p'dV#\P!RR4P 4P R4;'g\ p\4 RV RV 2#) z0Return the gateway origin for a specific vendor.-_ _GATEWAY_URLrf/TOOL_GATEWAY_DOMAINz://z -gateway.)r=r>upperreplacer&rstrip_DEFAULT_TOOL_GATEWAY_DOMAINrl)rexplicit_vendor_url shared_domains& rbuild_vendor_gateway_urlrzs ii6<<>+A+A#s+K*LL(Y[]^ddfmmnqrrr""II3R8>>@FFsKkkOkM%' (F89]O LLrc V^8dQhRRRR/#)rrr r "Optional[ManagedToolGatewayConfig]r)r"s"rr#r#sFFCFCeFrcT;'g\!V4pT;'g\!4pV'd V'gR#\WVRR7#)NT)rrrr)rzrXr )rgateway_builder token_readerrrs&&& r_vendor_gatewayrsO%AA)AA6JN#=='==@O  #6bqAE FFrc(V^8dQhRRRRRRRR/#) rrr r~Optional[Callable[[str], str]]r%Optional[Callable[[], Optional[str]]]r r|r)r"s"rr#r#s2BB B"@B7BCeBrc>\4'gR#\WV4#)zQResolve shared managed-tool gateway config for a vendor (entitled accounts only).N)rrrr~rs&&&rresolve_managed_tool_gatewayrs & ' ' 6L AArc V^8dQhRRRR/#)rrrr r|r)r"s"rr#r#s ==.S=`B=rc\RRV4#)adPerplexity ``search_type: "fast"`` is served to every Nous identity with no funding check, the anonymous guest tier included, so it needs a token this profile may use (guest-disabled and refresh rules live in the reader), not paid entitlement or a registered account. Search only: every other vendor route goes through :func:`resolve_managed_tool_gateway`. perplexityN)r)rs&rresolve_free_search_gatewayrs <| <rsO"  !%,A   8 $1&*-' $O + 0 eD"MFB=RRr