sj:dZddlmZddlZddlZddlZddlZddlmZm Z m Z dZ dZ d*d Z d+d,d Zd-d Zd.dZd/dZd0dZd1dZd/dZd2dZd3dZd4d Zd-d!Zd5d6d#Zd$dd$d%d7d)ZdS)8z0Shared helpers for direct xAI HTTP integrations.) annotationsN)AnyDictOptionali'ireturnboolc ddlm}|ddpdrdSnE#t$r8tjddrYdSYnwxYw ddlm}|dz }| sdStj | d }t|tr|d nd }t|tr|d nd }t|tr|dnd }t|tr|dnd }t|pdrdSt|tr|dnd }t|tr|d nd } t| t rU| D]R} t| tst| ddpdrdSSdS#t"$rYdSwxYw)uCheap probe — return True when xAI credentials are *likely* usable. Deliberately avoids :func:`resolve_xai_http_credentials` so callers in hot-paint paths (``hermes tools`` repaint, tool-registration scans, ``WebSearchProvider.is_available()``) don't incur disk locks or — in the OAuth path — a network token refresh. The ABC contract on :meth:`agent.web_search_provider.WebSearchProvider.is_available` explicitly forbids network calls for exactly this reason. Resolution order, fast-to-slow: 1. ``XAI_API_KEY`` env var (cheapest; covers explicit-key users). 2. ``~/.hermes/auth.json`` has a non-empty ``providers.xai-oauth.tokens.access_token`` (single file read, no expiry check, no refresh). 3. ``credential_pool.xai-oauth`` has any entry with a non-empty ``access_token`` (covers multi-account ``hermes auth add xai-oauth`` grants that are pool-only / ``manual:device_code``). Returns False on any exception so a corrupted auth store can't block other availability scans. Truthful refresh + expiry handling happens in ``search()`` (or whichever caller actually makes the request). r) get_secret XAI_API_KEYTget_hermes_homez auth.jsonFz utf-8-sigencoding providersN xai-oauthtokens access_tokencredential_pool)agent.secret_scoper strip ImportErrorosenvirongethermes_constantsrexistsjsonloads read_text isinstancedictstrlist Exception) r r auth_pathstorer xai_staterrrentriesentrys 2/home/agent/.hermes/hermes-agent/tools/xai_http.pyhas_xai_credentialsr,s.111111 J}b ) ) /R 6 6 8 8 4   :>>- , , 2 2 4 4 44   444444#O%% 3 !! 5 9.. .DDEE.8.E.EOEIIk***4 2Return a stable Hermes-specific User-Agent for xAI HTTP calls.r __version__unknownz Hermes-Agent/) hermes_clir6r%r5s r+hermes_xai_user_agentr9_sN *******      (; ( ((s  Dict[str, str]c"dtiS)u5Default headers for OpenAI-SDK and raw HTTP clients talking to xAI. Replaces the OpenAI Python SDK's identifying ``User-Agent: OpenAI/Python …`` so chat/completions and Responses traffic is attributed as Hermes Agent, matching the direct HTTP integrations (search, TTS, STT, image, video). z User-Agent)r9r+hermes_xai_default_headersr>hs /11 22r= section_nameDict[str, Any]c ddlm}|}t|tr||nd}t|tr|niS#t $ricYSwxYw)z=Return a top-level Hermes config section as a dict, or empty.r) load_configN)r0rBr!r"rr%)r?rBcfgsections r+_load_config_sectionrErs111111kmm+5c4+@+@J#'','''d$Wd33;ww;  sAA A&%A&r3rr1ct|tr|St|tr2|}|dvrdS|dvrdS|S)N>1onyestrueenabledT>0noofffalsedisabledF)r!rr#rlower)r3r1 normalizeds r+ _coerce_boolrS~sk% %[[]]((** > > >4 @ @ @5 Nr= Optional[int]c|dSt|trZ|}|dvrdS|dvrdS t |}n#t $r t cYSwxYwt|ttfr,t |}|dkrdSt|tSt S)zNormalize an xAI storage TTL. Returns: int seconds for an expiring file, None for permanent storage (omit expires_after on the wire). N>r r1>rLnonenullneverforever permanentr) r!r#rrQint ValueError&SAFE_XAI_STORAGE_EXPIRES_AFTER_SECONDSfloatmin%MAX_XAI_STORAGE_EXPIRES_AFTER_SECONDS)r3rRsecondss r+_coerce_expires_afterrbs }t% :[[]]((**  ( (4 O O O4 : OOEE : : :9 9 9 9 :%#u&&Ce** a<<47ABBB 11s AA10A1ct|}t|tr|dnd}t|tr|dnd}t|tr|ni}t |dd}t |dd}t |d}|||dS) aRead storage settings for xAI Imagine under image_gen/video_gen config. Supported config shape: image_gen: xai: storage: enabled: true public_url: true expires_after: null # omit for permanent public URLs The same shape is accepted under ``video_gen.xai.storage``. Storage is on by default so xAI returns permanent public URLs instead of short-lived CDN URLs. xaiNstoragerKT public_url expires_after)rKrfrg)rEr!r"rrSrb)r?rD xai_sectionrerKrfrgs r+read_xai_imagine_storage_configris#<00G(27D(A(AK'++e$$$tK,6{D,I,ISkooi(((tG#GT22:ggG7;;y11488Ggkk,77>>J)'++o*F*FGGM &  r=filename_prefix extensionOptional[Dict[str, Any]]ct|}|dsdStjtj}|d}t jjdd}|dpd}|d|d|d|t|dd }|d  |d |d <|S) zAReturn an xAI ``storage_options`` payload, or None when disabled.rKNz %Y%m%d-%H%M%S.bin-rf)filenamerfrg) ridatetimenowUTCstrftimeuuiduuid4hexlstripr) r?rjrkrCrttsshortextpayloads r+build_xai_storage_optionsrs *, 7 7C y>t     - -C o & &B JLL RaR E   3   (5C&;;;;e;;c;;3|,--G ?'#&#7 Nr=ct|}|dsdS|dd}n|ddz }d|dd |d krd nd}d |d |dS)z5User-facing notice for first xAI Imagine storage use.rKr rgNzwithout an automatic expiryiQz for about gz dayszMxAI Imagine storage is enabled so generated media gets a reusable public URL zK. xAI may bill for stored files and public URL hosting. Disable this with `zL.xai.storage.enabled: false` or set `expires_after` to change the retention.)ri)r?rC retentiondayss r+xai_storage_notice_textrs ), 7 7C y>r ?#1 ?#|4GGGGDAIISS2GG  : : :'3 : : :r= Optional[str]ct|}|sdS ddlm}|dz }|dd||dz }|rdS|t jt j dzd |S#t$r|cYSwxYw) zBReturn the storage notice once per Hermes home, then mark it seen.Nrr stateT)parentsexist_ok_xai_storage_notice_seen zutf-8r) rrrmkdirr write_textrsrtru isoformatr%)r?noticer marker_dirmarkers r+"maybe_mark_xai_storage_notice_seenrs $\ 2 2F t 444444$_&&0 555GGGG ==?? 4(+// ==GGIIDP[bccc  sAB2AB22 CCc ddlm}|ddtS#t$r3t tdpdcYSwxYw)uRead the explicit ``XAI_API_KEY`` through the shared secret machinery. Delegates to :func:`tools.tool_backend_helpers.resolve_provider_secret` (config → profile secret scope → env/.env → credential pool) so the preferred-key path enforces the exact same scope policy as the no-OAuth fallback branch — including failing closed under a multiplexed gateway turn. Never re-implement scope policy per-caller. rresolve_provider_secretr rd env_getterr )tools.tool_backend_helpersrr/rr#rrs r+_resolve_explicit_xai_api_keyrsy?FFFFFF&&}e VVVV ???=//5266<<>>>>>?s:AAhttps://api.x.ai/v1c ttdptdpdd} ddlm}|||S#t$r|p|cYSwxYw)aoBase URL for the explicit-API-key path. Honors ``HERMES_XAI_BASE_URL`` then ``XAI_BASE_URL`` (the same override pair the OAuth branch reads) and pins the origin with :func:`hermes_cli.auth._xai_validate_inference_base_url` so a tampered env override can't exfiltrate the bearer; on rejection it falls back to the default rather than raising. HERMES_XAI_BASE_URL XAI_BASE_URLr /rNfallback)r#r/rrstriphermes_cli.authauth _xai_validate_inference_base_urlr%)r1overrideauth_mods r+_resolve_explicit_xai_base_urlrs+,,   ( (   eggffSkk  #******88G8TTT ###"7"""#sA11BBF) force_refresh api_key_hintprefer_api_keyrrrc|rCttpd}|rd|tdS ddlm}ddlm}|d}|r||n| }|r|| }tt|ddpt|d d}tt|d dpt|d dp|j  d } ttd ptdpd d } || | } |rd|| dSn#t$rYnwxYw ddlm} | ddt} n@#t$$r3ttdpd} YnwxYwttdpd d } d| | dS)uResolve bearer credentials for direct xAI HTTP endpoints. Prefers Hermes-managed xAI OAuth credentials when available, then falls back to ``XAI_API_KEY`` resolved via ``hermes_cli.config.get_env_value`` so keys stored in ``~/.hermes/.env`` (the standard Hermes location) are honored — not just ones already exported into ``os.environ``. This keeps direct xAI endpoints (images, TTS, STT, etc.) aligned with the main runtime auth model and preserves the regression contract from PR #17140 / #17163. Set ``prefer_api_key=True`` to invert that order: check the explicit ``XAI_API_KEY`` first and use OAuth only as the fallback. This is for API-metered endpoints where a subscription OAuth bearer *authorizes* but misbehaves — ``/v1/responses`` x_search answers in a degraded Grok explanatory mode with no citations (#88040), and ``/v1/tts`` returns 403 (#87045). The key is read through :func:`tools.tool_backend_helpers.resolve_provider_secret` so profile secret scoping is identical to the fallback branch, and the base URL honors ``HERMES_XAI_BASE_URL`` / ``XAI_BASE_URL`` behind the same origin-pinning validation as the OAuth branch. Set ``force_refresh=True`` to perform an unconditional OAuth refresh. Reactive callers should also pass the rejected bearer as ``api_key_hint`` so a freshly loaded multi-account pool refreshes the exact issuing entry, not whichever entry its strategy would otherwise select first. r rd)providerapi_keybase_urlr) load_poolNrruntime_api_keyrruntime_base_urlrrrrrrr rr)r#rrragent.credential_poolrrrtry_refresh_matchingselectgetattrDEFAULT_XAI_OAUTH_BASE_URLrr/rr%rrr)rrr explicit_keyrrpoolr*rfallback_base_urloverride_base_urlrrrs r+resolve_xai_http_credentialsr(s>8::@bAAGGII  !':<<  ( 333333******y%% D % %l 3 3 3   "U]KKMME E,d 3 3 2unb11   %''  E-t 4 4 3uj"-- 32   %''&&++   / 0 0 ^,,    %''&&++  << &=    ''$        BFFFFFF))-=YYY BBBmM228b99??AAB=00I4IJJPPRRYYZ]^^H  s%E&F// F<;F<G:HH)rr)N)r-r#)rr#)rr:)r?r#rr@)r3rr1rrr)r3rrrT)r?r#rjr#rkr#rrl)r?r#rr#)r?r#rr)r)r1r#rr#)rrrrrrrr:)__doc__ __future__rrsrrrwtypingrrrr`r]r,r/r9r>rErSrbrirrrrrrr<r=r+rs66"""""" &&&&&&&&&&):%)9&<<<<~ 3 3 3 3 3 ))))3333        22226>0$&????"#####0 "& ]]]]]]]]r=