+ lHj])Rt^RIHt^RIt^RIt^RIt^RIt^RIHtH t H t Rt R#t R$t RRltRRltR R ltR R lt0R%mt0R&mtR RltRRltRRltRRltRRltRRltRRltRRltRRRRR R/R!R"lltR#)'z0Shared helpers for direct xAI HTTP integrations.) annotationsN)AnyDictOptionalzhttps://api.x.ai/v1c$V^8dQhRRRRRR/#)objrkeystrreturn)formats"3/home/ubuntu/.hermes/hermes-agent/tools/xai_http.py __annotate__rs!;;3;S;S;cT\V\4'dVPV4#R#N) isinstancedictget)rr s&&r _dict_getrs!%c4003773<:d:rcV^8dQhRR/#)rr boolr )r s"rrrsTrc^RIHpV!RR4;'gRP4'dR#^RIHpV!4R, pVP 4'gR#\ P!VPRR 74p\\\VR 4R 4R 4p\\VR 4;'gR4P4'dR#\\VR4R 4p\V\4;'d5\;QJdRV4F 'gK R# R#!RV44# \dR#i;i)u=Cheap probe: True when xAI credentials are *likely* usable. Deliberately avoids :func:`resolve_xai_http_credentials` (disk locks, OAuth network refresh) — hot-paint callers and ``WebSearchProvider.is_available()`` must not do network I/O. Checks, fast-to-slow: ``XAI_API_KEY``; ``providers.xai-oauth.tokens.access_token`` in ``auth.json``; any ``credential_pool.xai-oauth`` entry with an ``access_token`` (pool-only multi-account grants never write the providers singleton). Returns False on any exception so a corrupted auth store can't block other availability scans. ) get_secret XAI_API_KEYTget_hermes_homez auth.jsonFz utf-8-sigencoding providers xai-oauthtokens access_tokencredential_poolc3"TFPp\V\4;'d4\VPRR4;'gR4P 4xKR R#5i)r$rN)rrr rstrip).0es& r &has_xai_credentials..-sH1 ZaUVJq$  P PCnb(A(G(GR$H$N$N$P PZasAAA)agent.secret_scoperr'hermes_constantsrexistsjsonloads read_textrr rlistany Exception)rr auth_pathstorer#entriess rhas_xai_credentialsr8s".="%++22444#% 3 !! 9.. .DE9Yuk%BKPRZ[ y066B 7 = = ? ?Ie->?M'4(  SS1 Za1 SS S S1 Za1 .   s6)D:A8D:8D:D:%D:(D:, D:: E E cV^8dQhRR/#rr r r )r s"rrr4s&&s&rc\^RIHpRV!4P 2# \dR#i;i)z>Return a stable Hermes-specific User-Agent for xAI HTTP calls.get_version_infoz Hermes-Agent/zHermes-Agent/unknown)hermes_cli.version_infor= base_versionr4r<s rhermes_xai_user_agentr@4s4&</1>>?@@ &%&s  ++cV^8dQhRR/#)rr dict[str, str]r )r s"rrr=s33N3rcR\4/#)zaDefault headers for OpenAI-SDK and raw HTTP clients talking to xAI (replaces the SDK User-Agent).z User-Agent)r@r rrhermes_xai_default_headersrD=s /1 22rc$V^8dQhRRRRRR/#)rvaluerdefaultrr r )r s"rrrFs!dtrc\V\4'dV#\V\4'd>VP4P 4;p\ \ ,9d V\ 9#V#r)rrr r'lower _TRUE_WORDS _FALSE_WORDS)rFrG normalizeds&& r _coerce_boolrMFsR% %1D1D1F#F:;YeKe"e[(( Nrc V^8dQhRRRR/#)rrFrr z Optional[int]r )r s"rrrNs____rchVfR#\V\4'd4VP4P4pVR9dR#\ V4p\V\\34'g\ #\ V4^8:dR#\\ V4\4# \ d \ u#i;i)z\Normalize an xAI storage TTL: int seconds, or None for permanent storage (omit on the wire).N>r0nonenullneverrGforever permanent) rr r'rIint ValueError&SAFE_XAI_STORAGE_EXPIRES_AFTER_SECONDSfloatmin%MAX_XAI_STORAGE_EXPIRES_AFTER_SECONDS)rFs&r_coerce_expires_afterr\Ns }% ##% Y Y :JE ec5\ * *55u:?4^CJ8](^^  :9 9 :s BB10B1c V^8dQhRRRR/#)r section_namer r zdict[str, Any]r )r s"rrr_s  # . rc X^RIHp\\\V!4V4R4R4p\ V\ 4'dTM/pR\ VPR4R4R\ VPR4R4R\VPR44/# \dRpL{i;i) zRead ``.xai.storage`` (``image_gen``/``video_gen``) -> {enabled, public_url, expires_after}. On by default so xAI returns permanent public URLs, not short-lived CDN ones; null TTL = permanent.) load_configxaistorageNenabledT public_url expires_after) hermes_cli.configr`rr4rrrMrr\)r^r`rbs& rread_xai_imagine_storage_configrg_s1Ii |&LeTV_`$GT22gG< I 6=l7;;|#  rc \V4pVR,'gR#\PP\P4P R4pT RT R\ P !4PR, RVPR4;'gR 2pRVR \VR ,4/pVR ,e VR ,VR &V#) zAReturn an xAI ``storage_options`` payload, or None when disabled.rcNz %Y%m%d-%H%M%S-:NN.binfilenamerdre) rgdatetimenowUTCstrftimeuuiduuid4hexlstripr)r^rirjcfgtsrppayloads&$$ rbuild_xai_storage_optionsr|os *, 7C y>>     x|| , 5 5o FB!"!B4q)9)9")=(>a @P@PQT@U@^@^Y^?_`H)8\4LHYCZ[G ?'#&#7 Nrc V^8dQhRRRR/#)rr^r r r )r s"rrr~s##rc\V4pVR,'gR#RpVR,e#VR,R , pRVR RV^8wdRMR 2pR V R V R 2#) z5User-facing notice for first xAI Imagine storage use.rcrzwithout an automatic expiryrez for about gz dayszMxAI Imagine storage is enabled so generated media gets a reusable public URL zK. xAI may bill for stored files and public URL hosting. Disable this with `zL.xai.storage.enabled: false` or set `expires_after` to change the retention.iQ)rg)r^ry retentiondayss& rxai_storage_notice_textr~sw ), 7C y>>-I ?'?#|4 aDAIS2,FG  [!''3n5: :rc V^8dQhRRRR/#)rr^r r Optional[str]r )r s"rrrsS]rc\V4pV'gR#^RIHpV!4R, pVPRRR7W0 R2, pVP 4'dR#VP \ P P\ P4P4R,RR 7V# \dTu#i;i) zBReturn the storage notice once per Hermes home, then mark it seen.NrstateT)parentsexist_ok_xai_storage_notice_seen zutf-8r) rr-rmkdirr. write_textrqrrrs isoformatr4)r^noticer marker_dirmarkers& r"maybe_mark_xai_storage_notice_seenrs $\ 2F  4$&0 5.FGG ==??(++// =GGIDP[bc  sAB6!AB66 CCcV^8dQhRR/#r:r )r s"rrrs99s9rc ^RIHpV!RR4#)uRead ``XAI_API_KEY`` via ``resolve_provider_secret`` (config → profile scope → env/.env → pool). Both the preferred-key and the no-OAuth fallback paths go through here so scope policy (incl. failing closed in a multiplexed gateway turn) is never re-implemented per caller. resolve_provider_secretrra)tools.tool_backend_helpersrrs r_resolve_explicit_xai_api_keyrs C "=% 88rcV^8dQhRR/#r:r )r s"rrrsppprc^RIHp\V!R4;'gV!R4;'gR4P4P R4#)zG``HERMES_XAI_BASE_URL`` then ``XAI_BASE_URL``, stripped; '' when unset. get_env_valueHERMES_XAI_BASE_URL XAI_BASE_URLr/)rfrr r'rstriprs r_xai_base_url_overridersA/ }23ZZ}^7TZZXZ [ a a c j jkn oor force_refreshF api_key_hintprefer_api_keyc(V^8dQhRRRRRRRR/#)rrrrrrr rBr )r s"rrrs24I4I4I2?4IX\4I4Irc^RIHpV'd]\\4;'gR4P 4;p'd*\ 4pVP V\R7pRRRVRV/#^RIH pV!R 4pV'dVPV4MVP4p V'dV fVP4p \V R R4;'g\V R R4p \\V R R4;'g"\V RR4;'g VP4P 4PR 4p VP \ 4V R7p\V 4P 4'd RR R\V 4P 4RV/#^RIHp \4p \V !R4;'g\4P 4PR 4pRRRV RV/# \dLai;i)ugResolve bearer credentials for direct xAI HTTP endpoints. Default order: Hermes-managed xAI OAuth, then ``XAI_API_KEY`` (via ``get_env_value`` so ``~/.hermes/.env`` keys count). ``prefer_api_key=True`` inverts that for API-metered endpoints where the subscription OAuth bearer authorizes but misbehaves (x_search answers without citations, TTS 403s). Both branches honor ``HERMES_XAI_BASE_URL``/``XAI_BASE_URL`` behind the same origin-pinning validation. ``force_refresh=True`` forces an OAuth refresh; pass the rejected bearer as ``api_key_hint`` so a multi-account pool refreshes the issuing entry, not whichever its strategy selects first. Prefers Hermes-managed xAI OAuth credentials when available, then falls back to ``XAI_API_KEY`` resolved via ``hermes_cli.config.get_env_value`` so keys stored in ``~/.hermes/.env`` (the standard Hermes location) are honored — not just ones already exported into ``os.environ``. This keeps direct xAI endpoints (images, TTS, STT, etc.) aligned with the main runtime auth model and preserves the regression contract from PR #17140 / #17163. The key is read through :func:`tools.tool_backend_helpers.resolve_provider_secret` so profile secret scoping is identical to the fallback branch, and the base URL honors ``HERMES_XAI_BASE_URL`` / ``XAI_BASE_URL`` behind the same origin-pinning validation as the OAuth branch. See #87045, #88040. Nr)fallbackproviderraapi_keybase_url) load_poolr"runtime_api_keyr$runtime_base_urlrrr)hermes_cli.authauthr rr'r _xai_validate_inference_base_urlDEFAULT_XAI_BASE_URLagent.credential_poolrtry_refresh_matchingselectgetattrDEFAULT_XAI_OAUTH_BASE_URLrr4rfr)rrrauth_mod explicit_keyoverriderrpoolentryr$fallback_base_urlrrs$$$ rresolve_xai_http_credentialsrs,'3/L/N/T/TRT+U+[+[+]]<])+<dd'%Q_acBd  E-t 4 3 3uj"- 3 322  %'&&+  <<=S=U`q<r |  " " $ $ YL8I8O8O8QS]_gh h % 0+-G=0HH4HIOOQXXY\]H y':x HH    s1,G+(G++'G+&G+:G+BG++ G98G9i'i>1onyestruerc>rPnoofffalsedisabled)__doc__ __future__rrqr/osrutypingrrrrr[rXrr8r@rDrJrKrMr\rgr|rrrrrr rrrs6" &&-(9%)9&;>&3 4 6 _"  "$9p 4I"4IBF4I_d4I4Ir