epjDdZddlmZddlZddlZddlZddlmZmZddlm Z ddl m Z m Z ddl mZejeZddlmZdd lmZd Zd Zd Ze d GddZdZd=dZd>dZd?dZd@dZd@d Zd@d!Z dAd#Z!dBd%Z" dCdDd+Z# dCdEd,Z$d-Z%dBd.Z&dBd/Z' dFdGd0Z( dFdHd2Z) dCdId4Z*d5Z+d6Z,d7Z-dAd8Z. dCdJd<Z/dS)KzIGeneric managed-tool gateway helpers for Nous-hosted vendor passthroughs.) annotationsN)datetimetimezone) dataclass)CallableOptional)urlsplitget_hermes_home)managed_nous_tools_enabledznousresearch.comhttpsxT)frozenc8eZdZUded<ded<ded<ded<dS)ManagedToolGatewayConfigstrvendorgateway_originnous_user_tokenbool managed_modeN)__name__ __module__ __qualname____annotations__@/home/thesage/.hermes/hermes-agent/tools/managed_tool_gateway.pyrrs?KKKrrc$tdz S)zDReturn the Hermes auth store path, respecting HERMES_HOME overrides.z auth.jsonr rrrauth_json_pathr s   { **rreturnOptional[dict]cv t}|sdStj|d}|di}t |tsdS|di}t |tr|Sn#t$rYnwxYwdS)Nzutf-8)encoding providersnous) r is_filejsonloads read_textget isinstancedict Exception)pathdatar% nous_providers r_read_nous_provider_stater2$s  ||~~ 4z$..'.::;;HH["-- )T** 4! fb11 mT * * !  !      4s"B)AB);,B)) B65B6valueobjectOptional[datetime]ct|tr|sdS|}|dr |dddz} t j|}n#t $rYdSwxYw|j |tj }| tj S)NZz+00:00)tzinfo) r,rstripendswithr fromisoformat ValueErrorr9replacerutc astimezone)r3 normalizedparseds r_parse_timestamprC5s eS ! !tJ30_x/ ' 33 tt }x|44   X\ * **s#A88 BB expires_at skew_secondsintrct|}|dS|tjtjz }|t dt|kS)NTr)rCrnowrr? total_secondsmaxrF)rDrEexpires remainings r_access_token_is_expiringrMDsXz**Gt8< 555DDFFI As<0011 11r Optional[str]c4 ddlm}m} |d}n#|$rtjd}YnwxYwn$#t $rtjd}YnwxYwt |tr(|r|SdS)asRead the TOOL_GATEWAY_USER_TOKEN env override through the secret scope. Availability scans run both inside agent turns (scope installed) and in unscoped CLI paths, so this uses the Slack pattern: honor the scope's verdict when installed (a scoped miss does NOT borrow the process env under multiplex), fall back to ``os.environ`` only when unscoped. r)UnscopedSecretError get_secretTOOL_GATEWAY_USER_TOKENN) agent.secret_scoperPrQosgetenvr.r,rr:)rPrQexplicits r_read_user_token_overriderWLs8FFFFFFFF <!z";<httpr z-TOOL_GATEWAY_SCHEME must be 'http' or 'https')rTrUr:lower_DEFAULT_TOOL_GATEWAY_SCHEMEr=)schemes rget_tool_gateway_schemermsZ Y,b 1 1 7 7 9 9 ? ? A AF ,++ """ D E EErrc|ddd}tj|dd}|r|St }tjddd}|r |d|d|S|d|dtS) z0Return the gateway origin for a specific vendor.-_ _GATEWAY_URLrh/TOOL_GATEWAY_DOMAIN://z -gateway.)upperr>rTrUr:rstriprm_DEFAULT_TOOL_GATEWAY_DOMAIN)r vendor_keyexplicit_vendor_url shared_scheme shared_domains rbuild_vendor_gateway_urlr|sLLNN**344BBBJ)J3399;;BB3GG#""+--MI3R88>>@@FFsKKMEDDFDD]DDD O O O O1M O OOrgateway_builderOptional[Callable[[str], str]] token_reader%Optional[Callable[[], Optional[str]]]"Optional[ManagedToolGatewayConfig]ctsdS|pt}|pt}||}|}|r|sdSt|||dS)z8Resolve shared managed-tool gateway config for a vendor.NT)rrrr)r r|rer)rr}rresolved_gateway_builderresolved_token_readerrrs rresolve_managed_tool_gatewayrs & ' 't.J2J(B,B--f55N++--O t #%'    rc8t|||ptduS)a|Return True when gateway URL and a likely-usable Nous token are present. Defaults to :func:`peek_nous_access_token` so read-only availability scans avoid synchronous OAuth refresh. Callers that are about to make a real gateway request should use :func:`resolve_managed_tool_gateway` (which still defaults to the refresh-aware :func:`read_nous_access_token`). )r}rN)rrZ)rr}rs ris_managed_tool_gateway_readyrs4 ('!;%;     rtoolc d|S)zABase path for a managed vendor's REST routes on the gateway host.z/api/rrs rmanaged_vendor_base_pathrs 6  rc d|S)z=Media upload endpoint for a managed vendor, on the same host.z /api/uploads/rrs rmanaged_vendor_upload_pathrs #6 # ##rc|pt} |td}n#t$rYdSwxYw|sdS||t |t |dS)uDAbsolute URLs for a managed vendor, or ``None`` when none resolves. Address resolution only: entitlement is deliberately not consulted here. What an account may spend on a managed vendor is the gateway's own decision, stated in its refusals, and re-deciding it on the client can only ever disagree with the server. A caller that wants to hide its tools from users who could not call them at all does that in its ``check_fn``. ``None`` means no origin could be resolved — a misconfigured ``TOOL_GATEWAY_SCHEME`` — so there is nothing to call. rrN)originbase_url upload_path)r|_MANAGED_GATEWAY_VENDORrvr=rr)rr}builderrs rmanaged_vendor_endpointsrs9!9G01188== tt tA7??AA1&99  s #/ ==urlcpt|tr|sdS|pt} t |t }t |}n#t $rYdSwxYwt|jo|j|j f|j|j fkS)uTrue when ``url`` is on the Nous tool-gateway origin this client builds. Anything granting a URL extra trust — our bearer, reading files off disk to upload — must gate on this rather than on a name, so an arbitrary URL can never inherit that trust. F) r,rr:r|r rr=rrlnetloc)rr}rexpectedactuals ris_managed_nous_gateway_urlrs c3  syy{{u9!9GGG$;<<==#))++&& uu    gFM6=#AhoW_WfEg#ggs>A55 BBr-cBt||siS|pt} |}n5#t$r(}td||icYd}~Sd}~wwxYwt |t r|siSdd|iS)aLive auth headers for a managed gateway URL, or ``{}`` when not managed. Read fresh on every call rather than cached: a Nous access token expires within the hour, and a long session would otherwise keep presenting a dead bearer. Returns ``{}`` rather than raising when no token is available, so a caller can report "sign in" instead of sending an unauthenticated request. z,Managed gateway token read failed for %s: %sN AuthorizationzBearer )rrer.r`rar,rr:)rr}rrtokenrds rmanaged_gateway_auth_headersr-s 'sO < < (B,B%%''  CS#NNN  eS ! ! 6u{{}}66 77s ( AAAAg.@gN@gr@c0 |}|did}t|tr(|r|Sn#t $rYnwxYwd|jdS)a A model-actionable reason from a gateway refusal, or a generic one. The gateway's 4xx bodies carry deliberate guidance (rate-limit waits, size caps, "you could not submit anyway"), so surface `error.message` verbatim rather than a bare status code. errormessagez%the gateway refused the upload (HTTP ))r(r+r,rr:r. status_code)responsepayloadrs r_describe_media_upload_refusalr]s --//++gr**..y99 gs # # #  #==?? "      J83G J J JJsA9A== B  B  server_urlrOptional[Callable]c&tsdSt|tr|dsdSt t}|jd|j}||d fd }|S) uAsync ``(data, mime) -> argument value`` uploader for one managed vendor. Returns ``None`` when there is no usable upload endpoint (not a managed Nous URL, or no ``upload_path``); callers then refuse local paths with a clear message instead of silently forwarding them. The three steps of the protocol: 1. POST ``origin + upload_path`` with the declared content type and exact byte length, using the same live auth headers as the vendor calls. The gateway answers with a presigned single-object PUT URL (short expiry; type and length are signed into it) and an upload token. 2. PUT the bytes to that URL. This goes directly to storage — never through the gateway — which is what removes the request-size ceiling. 3. Return ``nous-upload:`` for the tool argument. The token is bound to this Nous principal and is redeemable only through the gateway, so it is inert anywhere else it might end up. Nrrrtr0bytesmimerr!c Kddl}ddlm}t }|st d|t }||4d{V}|||t|dd{V}dddd{Vn#1d{VswxYwY|j dkrt t| | }n#t$rd}YnwxYwt|tr|dnd} t|tr|d nd} t| t"r| rt| t"r| st d |t t$t& } || 4d{V}|| |d |i d{V} dddd{Vn#1d{VswxYwY| j dkrt d| j dd| S)Nr)create_ssrf_safe_async_clientz.no Nous credential is available for the upload)timeout) contentType contentLength)headersr( uploadUrlrz+the gateway's upload response was malformed)readwritez Content-Type)contentrz!storage refused the upload (HTTP rz nous-upload:)httpxtools.url_safetyrr RuntimeErrorTimeout%_MEDIA_UPLOAD_PRESIGN_TIMEOUT_SECONDS AsyncClientpostlenrrr(r.r,r-r+r&_MEDIA_UPLOAD_PUT_READ_TIMEOUT_SECONDS'_MEDIA_UPLOAD_PUT_WRITE_TIMEOUT_SECONDSput)r0rrrrpresign_timeoutclientpresignr upload_urlr put_timeoutrr} presign_urlrrs ruploadz,build_managed_media_uploader..uploads BBBBBB.z?LYY QOPP P --(MNN$$_$==       "KK%)CIIFF(G                             # % %=gFFGG G llnnGG   GGG 1;GT1J1JTW[[---PT (27D(A(AK G$$$t:s++ N  Nz%QT?U?U NZ_ NLMM Mmm 179$  10EEE ] ] ] ] ] ] ] :tnVZE[ \\\\\\\\C ] ] ] ] ] ] ] ] ] ] ] ] ] ] ] ] ] ] ] ] ] ] ] ] ] ] ] ?c ! !U3?UUUVV V%e%%%s6&/B'' B14B1 C55 DD!H HH)r0rrrr!r)rr,r startswithr r:rlr)rrr}rpartsrrrs` `` @rbuild_managed_media_uploaderrns0 'z? C Ct k3 ' '{/E/Ec/J/Jt S__**,, - -E / / / /F*[**K2&2&2&2&2&2&2&2&2&h Mr)r!r")r3r4r!r5)rDr4rErFr!r)r!rN)r!r)rrr!r)NN)rrr}r~rrr!r)rrr}r~rrr!r)N)rrr}r~r!r")rr4r}r~r!r)rr4r}r~rrr!r-) rr4rr4r}r~rrr!r)0__doc__ __future__rr(loggingrTrr dataclassesrtypingrr urllib.parser getLoggerrr`hermes_constantsr tools.tool_backend_helpersr rwrkr^rr r2rCrMrWrZrermr|rrrrrrrrrrrrrrrrrsOO""""""  ''''''''!!!!!!%%%%%%%%!!!!!!  8 $ $,,,,,,AAAAAA1&*-' $+++ " + + + +2222,*8 F F F F P P P P"7;:>67;:>J! $$$$7;@7;hhhhh27;:>88888R)-%*.&*/'KKKK(7;:> UUUUUUUr