+ lHj"Rt^RIHt^RIt^RIHt^RIHtHtH t ]P!] 4t .ROt ^ t]!0Rm4t]!RR7!RR44tR R ltR R ltR RltRRRlltRRltRtRRltRRltRRltRRltR#)zConfiguration and availability gate for connector tools. Availability fails closed; the gateway remains authoritative for entitlement and route availability. ) annotationsN) dataclass)AnyCallableOptionalConnectorConfigT)frozenc<]tRt^t$RtR]R&]RRl4tRtR#)rTboolenabledc V^8dQhRRRR/#)rawrreturnr)formats"D/home/ubuntu/.hermes/hermes-agent/tools/connectors/gateway/config.py __annotate__ConnectorConfig.__annotate__#s3?c \V\4'd V!VR7#\V\4'd#V!\VP R4R4R7#V!4#)z:Malformed configuration falls back to the enabled default.)r r T) isinstancer dict _coerce_boolget)clsrs&&rfrom_rawConnectorConfig.from_raw"sK c4 s# # c4 |CGGI,>EF Fu rrN) __name__ __module__ __qualname____firstlineno__r __annotations__ classmethodr__static_attributes__rrrrrs GTrc$V^8dQhRRRRRR/#)r valuerfallbackr rr)rs"rrr,s!   t  rc\V\4'dV#VfV#\V\\34'd \V4#\V\4'd&VP 4P 4\9#V#)N)rr intfloatstrstriplower_FALSE_STRINGS)r&r's&&rrr,se%  }%#u&&E{%{{}""$N:: OrcV^8dQhRR/#)r rrr)rs"rrr8s . ._ .rc^RIHpV!4;'g/p\VPR4\4'dVPR4M/p\V\4'g/p\ P VPR44# \d6p\PRT4\ P R4uRp?#Rp?ii;i))load_config_readonlytools connectorsz#Failed to load connector config: %sN) hermes_cli.configr2rrrrr Exceptionloggerdebug)_loadcfg tools_cfges r load_configr=8s .Cgmm(237773CT(J(JCGGG$PR )T**I'' l(CDD . :A>''--.s#B A6B C *CC C cV^8dQhRR/#r rr r)rs"rrrFs R R$ Rrcn^RIHpV!4p\VP4;'d VP#)aThe portal has enabled connectors for this account. The gateway answers 404 to every ``/v1/connectors`` route for an account the portal has not enabled, and 404 is indistinguishable from "dark" by design. Paid access or a free tool pool says nothing about that, so entitlement is the wrong predicate here: the portal mints its answer onto the token as ``managed_tools`` and this reads only that. A token minted before the claim existed carries none and reads as not enabled.)get_nous_portal_account_info)hermes_cli.nous_accountrAr logged_inmanaged_tools_rolled_out)rA account_infos rrDrDFs/E/1L  && ' Q QL,Q,QQrc$V^8dQhRRRRRR/#)r config_loaderz'Optional[Callable[[], ConnectorConfig]]entitlement_checkzOptional[Callable[[], bool]]rr r)rs"rrrTs&:3 rcJT;'g\pV!4P'gR#Vf8^RIHp^RIHpV!V!44'g\ 4'dR#\p\V!44# \d"p\PRT4Rp?R#Rp?ii;i)aFail closed so availability failures do not become model-visible errors. The one gate for the connectors surface, and the tool's ``check_fn``: outside it the tool is not in the schema at all, so the model never narrates a gateway 404 to a user the portal has not enabled. Free-tier identities are always in, and so is a user with no identity who may get one; accounts are in only when the portal says so via the token claim.FN)is_guest_state)_read_nous_provider_stateTz'Connector availability check failed: %s) r=r hermes_cli.anon_authrJtools.managed_tool_gatewayrKguest_identity_pendingrDr r6r7r8)rGrHresolved_loaderrJrKr<s&& rconnectors_availablerPTs'66; (((  $ ; L79::>T>V>V 8 %'((  >Bs-A6A6"A6A6 A66 B"BB"cV^8dQhRR/#r?r)rs"rrrqs 5 5 5rc^RIHpHp^RIHpHpV!4'dV!4fV!4'dR#V!4pV'*;'g\ VR,4#)zNo Nous identity or bearer yet, and a guest one may be created (``nous.guest`` is not false and no earlier mint was refused for good). No network: this feeds the ``check_fn``.) guest_allowedlast_mint_failure)rKpeek_nous_access_tokenF retryable)rLrSrTrMrKrUr )rSrTrKrUfailures rrNrNqsIF\ ??79EI_IaIa!G; 4 4$w{344rz'Hosted connectors could not be set up. cV^8dQhRR/#r r Optional[str]r)rs"rrrshh]hrcz^RIHpHpV!4;p'gR#\V!VR,VR,R7,#)zZThe last failed guest creation for this profile, worded with the wait still left, or None.)anon_failure_copyrTN error_code retry_after)r^)rLr\rT _SETUP_FAILED)r\rTrWs rguest_setup_failurer`s5I(* *G * ,W\-BPWXePfg ggrcV^8dQhRR/#rYr)rs"rrrsII}Irc\4'gR#^RIHp^RIHpV!RR7eR#\4;'g\ R,# Td!p\ \ T4,uRp?#Rp?ii;i)aCreate the guest identity on the first hosted connector action, synchronously. Returns None when an identity exists or was just created, else the failure copy for the model: a refusal, a rate limit or an unreachable portal, with the wait when there is one.N)ensure_portal_identity) AuthErrorT)explicitzTry again shortly.)rNrLrchermes_cli.auth_constantsrdr_r+r`)rcrdexcs rensure_guest_identityrhsh " # #;3( !4 0 < =  H HM4H$HH (s3x''(s A A4A/)A4/A4c V^8dQhRRRR/#)r session_idrZrr+r)rs"rrrsNNmNNrcZ^RIHpV!RR4;'g\T;'gR4#)aRThe key an operation is registered under: the gateway session key the RPCs look up by (``HERMES_SESSION_KEY``), falling back to the agent's session id where no gateway bound one. The agent id alone is wrong on the desktop: compaction rotates it mid-turn while the gateway key stays, and a card keyed by the old id can no longer be driven.get_session_envHERMES_SESSION_KEY)gateway.session_contextrmr+)rjrms& roperation_session_keyrqs* 8 / 4 M MJro0noofffalse)NN)__doc__ __future__rlogging dataclassesrtypingrrr getLoggerrr7__all__rx frozensetr.rrr=rDrPrNr_r`rhrqrwrrrrs #!**   8 $ :; $     . R: 5: hI$N/r