+ lHjl7a0t$Rt^RIHt^RIt^RIt^RIHt^RIH t H t H t ^RI H t ]P!]4tRtRt0R6mtRR /R R lltR7RR /R R llltRRltRRlt]tRRltRR/RRlltRRltRRltRRltR8RRlltRR ltR!R"lt R#t!R$R9/t"R%R:R$R;/t#Rz*Shared helpers for tool backend selection.) annotationsN)Path)AnyDictOptional)is_truthy_valuelocalauto force_freshFc V^8dQhRRRR/#)r boolreturn)formats"?/home/ubuntu/.hermes/hermes-agent/tools/tool_backend_helpers.py __annotate__rs  t  c^RIHpV'd V!RR7MV!4p\VP4;'d VP# \ dR#i;i)u Coarse gate: entitled to the Nous Tool Gateway (paid Portal access OR a live free pool). Fails closed on unknown/error — never blocks startup. Callers narrow per category via ``tool_gateway_entitled_for``; ``force_fresh`` is for flows needing a just-bought grant.)get_nous_portal_account_infoTr F)hermes_cli.nous_accountrr logged_intool_gateway_entitled Exception)r r account_infos$ rmanaged_nous_tools_enabledrsQHJU4F9; L**+RR 0R0RR s A +A A AAc$V^8dQhRRRRRR/#)r capabilitystrr r rr)rs"rrr s#55c57;5HK5rcz^RIHpHpV!V!VR7VRR7pV'dV#V R2# \dLi;i)zHReturn account-aware guidance for an unavailable Nous Tool Gateway path.)&format_nous_portal_entitlement_messagerrT)rin_chatzY is unavailable. Run `hermes model` to refresh your Nous Portal login and billing status.)rr!rr)rr r!rmessages&$ r%nous_tool_gateway_unavailable_messager$ s]   R8 ([ Aj N l4 45    s!,, ::c V^8dQhRRRR/#r value object | Nonerrr)rs"rrr1s11M1c1rc\T;'g\4P4P4pT;'g\#)z)Return a normalized browser provider key.)r_DEFAULT_BROWSER_PROVIDERstriplower)r'providers& r normalize_browser_cloud_providerr.1s655556<<>DDFH  0 000rc V^8dQhRRRR/#r&r)rs"rrr7sGG]GsGrc\T;'g\4P4P4pV\9dV#\#)z=Return the requested modal mode when valid, else the default.)r_DEFAULT_MODAL_MODEr+r,_VALID_MODAL_MODES)r'modes& rcoerce_modal_moder47s; u+++ , 2 2 4 : : @sP*++0BCW0X0X m+3355 s)A AAmanaged_enabledc ,V^8dQhRRRRRRRRRR /#) r modal_moder( has_directr managed_readyr?z bool | Nonerzdict[str, Any]r)rs"rrrLs222M2$2/321<2HV2rc  \V4pVf \4pT;'dTpRV'dRMRRV'dRMR/pTPYE'dRM V'dRMR4pRTRTRTRTRVR8H;'dV'*R V/#) zResolve direct vs managed Modal backend: ``direct``/``managed`` are exclusive; ``auto`` prefers managed when available, else direct.Nmanageddirectrequested_moder3rBrCmanaged_mode_blockedselected_backend)r4rget)rArBrCr?rG managed_ok exclusiverIs&$$$ rresolve_modal_backend_staterMLs 'z2N46 22]JIz8t=I }}Z XQUW nfnlT^ ] "Ni$?$W$WDW  0 22rc V^8dQhRRRR/#)r namerrr)rs"rrr_s33S3S3rc^RIHpV!VR4;'gRP4# \d3\P !TR4;'gRP4u#i;i)zRead a credential env var under the active profile secret scope; raw env fallback only if ``agent.secret_scope`` cannot import (a packaging edge must never lose the key).) get_secret)agent.secret_scoperQr+rosgetenv)rOrQs& rr:r:_sY314$**1133 3 $#))r00223s))(A&A&%A&c V^8dQhRRRR/#)r env_varrrr)rs"rrris33rc^RIHp\V!V4;'gR4P4# \dR#i;i)zQ``.env`` value via ``hermes_cli.config.get_env_value`` (``""`` when unavailable).) get_env_valuerR)hermes_cli.configrYrr+r)rWrYs& r _dotenv_valuer[is=3=)//R06688 s11 AAc$V^8dQhRRRRRR/#)r provider_idrrWrr r)rs"rrrrs!   c d rc`V'gR#^RIHpV!VRV 24# \dR#i;i)a``hermes auth remove `` records ``env:`` in ``suppressed_sources`` and promises the variable is ignored until ``hermes auth add``; a value still living in a long-running gateway's process environment (inherited across update restarts) must honor that too.F)is_source_suppressedzenv:)hermes_cli.authr_r)r]rWr_s&& r_env_source_suppressedrars8 8#K4y1ABB s  --c(V^8dQhRRRRRRRR/#)r rWrr] config_valuerr)rs"rrrs)((S(s(#(03(rc<\T;'gR4P4pV'dV#\W4pV'g\V4;p'dV#^RIHpV!4'dR#V'g=V'd*\V!V4;'gR4P4M \V4pV'g V'gV#^RIH pVRV 23FpV!V4p V e'V P4'dV P4MRp \\V RR4;'g\V RR4;'gR4P4pV'gKVu# R# \ dLi;i \ d#p \PRYT 4Rp ? R#Rp ? ii;i) uResolve a voice-provider API key (single owner for STT/TTS lookup). Order: explicit ``config_value`` -> profile secret scope / env -> ``.env`` via ``env_getter`` (or ``hermes_cli.config.get_env_value``) -> credential pool for ``provider_id``. Under an active multiplex turn the profile scope is authoritative: a miss returns ``""`` rather than borrowing another profile's env or pool. Never raises. The env/.env tier is skipped entirely while ``env:`` is suppressed for ``provider_id`` (#116155). Resolution order (fixes #68003 — keys added via ``hermes auth add `` were invisible to the voice tools, which only consulted env/.env): rR)is_multiplex_active) load_poolzcustom:Nruntime_api_key access_tokenz,Could not read %s credential pool for %s: %s)rr+rar:rSrerr[agent.credential_poolrfhas_credentialspeekgetattrloggerdebug) rWr]rc env_getterkeyenv_suppressedrerfpool_keypoolentryexcs &&&& rresolve_provider_secretrvsv l  b ! ' ' )C  +KAN &8&AAsA  :   ! 8Bc*W%++,224 V]H^ +  `3$ }&=>HX&D#'#38L8L8N8NDIIKTXEge%6;wun^`?a"UW s ? %    ` C[[^__ `sHE1E.6*E.!E.6E.E.E. E+*E+. F9FFcV^8dQhRR/#)r rrr)rs"rrrs H Hc HrcB\RR4;'g \RR4#)uPrefer VOICE_TOOLS_OPENAI_KEY, else OPENAI_API_KEY (scope-aware, pool fallback for the latter). Must go through the secret scope: a raw ``os.environ`` read could bill another profile's account under multiplex. Outside a multiplexed turn, ``OPENAI_API_KEY`` additionally falls back to the credential pool (``hermes auth add openai-api``) via ``resolve_provider_secret`` — same #68003 fix as the other voice providers. The dedicated voice-tools override remains env/scope-only. VOICE_TOOLS_OPENAI_KEYrROPENAI_API_KEYz openai-api)rvrrrresolve_openai_audio_api_keyr{s, $$.use_gateway`` is set in config.yaml. Never raises.) load_config use_gatewayF)rZrrJ isinstancedictrr)r}rsections& rprefers_gatewayrsY1=&&B++N;'4(XX_W[[=W-XX sA(AA A)(A)nouswebbrowserc V^8dQhRRRR/#)r rrrzdict[str, Any] | Noner)rs"rrrs#"7rc^RIHpV!4;'g/p\V\4'dVP V4MRp\V\4'dV#R# \ dR#i;i)z@The RAW (unmerged) config.yaml mapping for ``section``, or None.)read_raw_config_readonlyN)rZrrrrJr)rrcfgraws& r _raw_sectionrs_>&(..B",S$"7"7cgggT d++s55 sAAAA A+*A+c V^8dQhRRRR/#)r rrr str | Noner)rs"rrrsCJrcd\V4pVfR#\VPR44'd\#\PV\ 4FZpVPV4e7\ VPV44P4P4MRpV'gKXVu# R#)aTHE single runtime read of the persisted `hermes tools` selection: ``"nous"`` (managed gateway row), a vendor name (direct, own credentials), or ``None`` (never configured -> legacy autodetect allowed). Reads the RAW config.yaml so key presence means "actually written", not "schema default"; a raw ``local`` is therefore a real user selection. Legacy shim: ``use_gateway: true`` was only ever written by the managed row, so it maps to ``"nous"`` regardless of the name key. Never raises.NrrR) rrrJNOUS_MANAGED_PROVIDER_SELECTION_NAME_KEYS_DEFAULT_NAME_KEYSrr+r,)rrrptexts& rread_selectionrs w C {sww}-..$$#''1CD47GGCL4Ls3773< &&(..0RT 4KE rc V^8dQhRRRR/#)r r Optional[str]rrr)rs"rrrs ! !m !z !rcV'dc\R4;'g/p\VPV R24;'gR4P4P 4pV'dV#\ R4#)a<Stored selection that decides ONE web capability (``"search"`` / ``"extract"``): ``web._backend`` when set (``"nous"`` = managed gateway, a vendor name = that vendor direct), else the shared :func:`read_selection`. Lets search and extract each choose between the user's own key and the Nous Tool Gateway.r_backendrR)rrrJr+r,r)rrpins& rread_web_capability_selectionrs` 5!''R#''ZL1288b9??AGGI J %  rc V^8dQhRRRR/#)r rrrr r)rs"rrrsUUcUdUrca\V4eR#\PVR4pV'd \V4MRoSRJ;'d;\;QJdV3RlV4F 'gK R# R#!V3RlV44#)zTrue when ANY selection signal was ever written for the section (wider than read_selection: per-capability web keys count too).NTc3<"TF7p\SPV4;'gR4P4xK9 R#5irRN)rrJr+).0rprs& r #selection_exists..s2"Tes3swws|'9'9r#:#@#@#B#Bes !AAFr)r_EXTRA_SELECTION_KEYSrJrany)rextrars& @rselection_existsrshg* ! % %gr 2E#(,w dC d? T Tss"Te"TssTsTs"Te"TTTrzdict[str, dict[str, str]]REMOVED_BACKENDSc$V^8dQhRRRRRR/#)r rrrOrrr)rs"rrrs&\\#\S\]\rc\PV/4PT;'gRP4PR4P44#)zExplanation for a backend that used to ship in-tree, or None. ``name`` tolerates the quoted form callers pass to selection_error().rRz'")rrJr+r,)rrOs&&rremoved_backend_notersE    , 0 0$**"1C1C1E1K1KE1R1X1X1Z [[rc(V^8dQhRRRRRRRR/#)r rrselection_namefailurerr)rs"rrrs.HHSH#HHHrcB\W4;'gTpV RV RV R2#)zEThe uniform honest-error contract for a selected-but-broken provider.z is configured to use z (set via hermes tools), but z". Run 'hermes tools' to change it.)r)rrrs&&&rselection_errorrs:"7;FFwGi-n-=>")#E GHrcV^8dQhRR/#r6r)rs"rrr sKKtKrcP\\R4;'g \R44#)zTrue when FAL_KEY is set (scope/env, else ``.env`` for CLI paths that run before dotenv loads) to a non-whitespace value, so tool-side and CLI setup-time checks agree.FAL_KEY)r r:r[rrrfal_key_is_configuredr s" "9-IIy1I JJr>r rFrE)zthe Nous Tool Gatewayr)search_backendextract_backend)cloud_provider)backend)r-rr)N).__conditional_annotations____doc__ __future__rloggingrTpathlibrtypingrrrutilsr getLogger__name__rmr*r1r2rr$r.r4normalize_modal_moder>rMr:r[rarvr{rrrrrrrrrr__annotations__rrr)rs@rrs0" &&!   8 $#2 e 5>C55"1 G ) 2?C2&3 (V H EF"#6|L>* !U/1+0\ HKr