epj,dZddlmZddlZddlZddlmZddlmZm Z ddl m Z ej e ZdZdZhd Zd d d-dZ d.d d d/dZd0dZd0dZd0dZd1dZddd2d!Zd3d#Z d4d5d(Zd6d)Zd7d+Zd1d,ZdS)8z*Shared helpers for tool backend selection.) annotationsN)Path)AnyDict)is_truthy_valuelocalauto>r directmanagedF force_freshr boolreturnc ddlm}|r |d}n |}|jsdS|jS#t$rYdSwxYw)uReturn True when the user is entitled to the Nous Tool Gateway. Entitlement is paid Nous Portal service access OR a live free tool pool (``tool_gateway_entitled``). Per-category coverage (the pool funds image but not video, etc.) is narrowed by callers via ``tool_gateway_entitled_for``; this coarse gate only answers "is any managed tool usable at all". Tool Gateway availability fails closed on unknown/error entitlement. We intentionally catch all exceptions and return False — never block startup. ``force_fresh=True`` is for interactive configuration flows that should reflect a just-purchased subscription, credits, or pool grant immediately. r)get_nous_portal_account_infoTr F)hermes_cli.nous_accountr logged_intool_gateway_entitled Exception)r r account_infos @/home/thesage/.hermes/hermes-agent/tools/tool_backend_helpers.pymanaged_nous_tools_enabledrs HHHHHH  :77DIIILL7799L% 511 uus&11 ??the Nous Tool Gateway capabilitystrcz ddlm}m}||}|||}|r|Sn#t$rYnwxYw|dS)zHReturn account-aware guidance for an unavailable Nous Tool Gateway path.r)&format_nous_portal_entitlement_messagerr )rzY is unavailable. Run `hermes model` to refresh your Nous Portal login and billing status.)rrrr)rr rrrmessages r%nous_tool_gateway_unavailable_messager/s          43 LLL 88 !     N         0 0 0s $( 55value object | Nonect|pt}|ptS)z)Return a normalized browser provider key.)r_DEFAULT_BROWSER_PROVIDERstriplower)r providers r normalize_browser_cloud_providerr'Js955566<<>>DDFFH  000ct|pt}|tvr|StS)z=Return the requested modal mode when valid, else the default.)r_DEFAULT_MODAL_MODEr$r%_VALID_MODAL_MODES)r modes rcoerce_modal_moder-PsD u++ , , 2 2 4 4 : : < managed_mode_blockedselected_backend)r-r/r)r<r=r>r;rBnormalized_moderCrDs rresolve_modal_backend_staterFis'z22N*:66O466)#;O(;)##(7SMS99t H $ $'1;88t(7oMo99[eOoxxko) & 4,   r(namec ddlm}||dpdS#t$r,t j|dpdcYSwxYw)zRead a credential env var under the active profile secret scope. Falls back to a raw read only when ``agent.secret_scope`` cannot be imported, so a packaging edge never leaves the caller without a key. r) get_secret)agent.secret_scoperIr$rr7r8)rGrIs r_scoped_credentialrLs 3111111 4$$*11333 333 $##)r00222223s%(3AArJenv_var provider_id config_valuecLt|pd}|r|St|}|r|S ddlm}|rdSn#t $rYnwxYw|-t||pd}nF ddlm}t||pd}n#t$rd}YnwxYw|r|S|sdS ddl m }|d|fD]} || } | | s$| } | ;tt| ddpt| d dpd}|r|cSn4#t $r'} td ||| Yd} ~ nd} ~ wwxYwdS) uResolve a voice-provider API key. Single owner for STT/TTS key lookup. Resolution order (fixes #68003 — keys added via ``hermes auth add `` were invisible to the voice tools, which only consulted env/.env): 1. An explicit ``config_value`` from config.yaml, when the caller has one. 2. The environment / ``~/.hermes/.env``. Under a multiplexed gateway turn this reads the active profile's secret scope (authoritative — a scope miss must NOT borrow another profile's ``os.environ``; see ``agent/secret_scope.py``). Outside multiplexing it reads ``hermes_cli.config.get_env_value`` (os.environ, then ``.env``), matching the tools' historical behaviour exactly. 3. The credential pool / auth store for ``provider_id`` (``hermes auth add ``). Skipped under an active multiplex turn, where only the profile scope is authoritative for credentials. Never raises — credential resolution must not hard-fail on a pool or config read; returns ``""`` when no key is found anywhere. ``env_getter`` lets callers supply their module-level ``get_env_value`` wrapper (transcription_tools / tts_tool expose one that tests patch); when omitted, ``hermes_cli.config.get_env_value`` is used directly. rJr)is_multiplex_activeN get_env_value) load_poolzcustom:runtime_api_key access_tokenz,Could not read %s credential pool for %s: %s)rr$rLrKrQrhermes_cli.configrS ImportErroragent.credential_poolrThas_credentialspeekgetattrloggerdebug) rMrNrO env_getterr keyrQrSrTpool_keypoolentryexcs rresolve_provider_secretres<  " # # ) ) + +E  W % %C    ::::::    2        **W%%+,,2244  7 7 7 7 7 7mmG,,23399;;CC   CCC   r 333333 %&= &=&=>  H9X&&D|4#7#7#9#9|IIKKE}0"555."55egg           :              2sBA AA2C CCBE0.E00 F!:FF!cBtddptddS)uPrefer the voice-tools key, but fall back to the normal OpenAI key. Routed through the profile secret scope rather than reading ``os.environ`` directly: in a multiplex gateway serving several profiles from one process, ``os.environ`` reflects whichever profile's ``.env`` happened to load at boot, not the profile the current turn belongs to. A raw read here lets one profile's TTS reply / voice-note transcription authenticate as — and get billed against — a different profile's OpenAI account. Same routing the WeChat send path and ``agent/vertex_adapter`` already use; see ``agent/secret_scope.py``. Outside a multiplexed turn, ``OPENAI_API_KEY`` additionally falls back to the credential pool (``hermes auth add openai-api``) via ``resolve_provider_secret`` — same #68003 fix as the other voice providers. The dedicated voice-tools override remains env/scope-only. VOICE_TOOLS_OPENAI_KEYrJOPENAI_API_KEYz openai-api)rer(rresolve_openai_audio_api_keyrjs+$ 8"== C "#3\ B Br(config_sectionc ddlm}|pi|}t|tr$t |ddSn#t $rYnwxYwdS)zReturn True when the user opted into the Tool Gateway for this tool. Reads ``
.use_gateway`` from config.yaml. Never raises. r) load_config use_gatewayF)default)rWrmget isinstancedictrr)rkrmsections rprefers_gatewayrts  111111;==&B++N;; gt $ $ N"7;;}#=#=uMMM M N      5sAA!! A.-A.ctdpd}|% ddlm}|d}n#t$rd}YnwxYwt |o|S)a+Return True when FAL_KEY is set to a non-whitespace value. Consults both ``os.environ`` and ``~/.hermes/.env`` (via ``hermes_cli.config.get_env_value`` when available) so tool-side checks and CLI setup-time checks agree. A whitespace-only value is treated as unset everywhere. FAL_KEYNrrR)rLrWrSrrr$)r rSs rfal_key_is_configuredrw%s y ) ) 1TE }  7 7 7 7 7 7!M),,EE   EEE  '%++-- ( ((s ' 66)r rrr)r)rrr rrr)r r!rr)rr) r<r!r=rr>rr;r?rr@)rGrrr)rJN)rMrrNrrOrrr)rr)rkrrr)__doc__ __future__rloggingr7pathlibrtypingrrutilsr getLogger__name__r]r#r*r+rrr'r-r/r:rFrLrerjrtrwrir(rrs00"""""" !!!!!!  8 $ $$2227<8.61111 $$$$    "$( $$$$$$N 3 3 3 3" ^^^^^B.    ))))))r(