epj70dZddlmZddlZddlZddlZddlZddlmZm Z m Z dZ dZ d&d Z d'd(d Zd)d Zd*dZd+dZd,dZd-dZd+dZd.dZd/dZd0d Zd!dd"d1d%ZdS)2z0Shared helpers for direct xAI HTTP integrations.) annotationsN)AnyDictOptionali'ireturnboolc ddlm}|ddpdrdSnE#t$r8tjddrYdSYnwxYw ddlm}|dz }| sdStj | d }t|tr|d nd }t|tr|d nd }t|tr|dnd }t|tr|dnd }t|pdrdSt|tr|dnd }t|tr|d nd } t| t rU| D]R} t| tst| ddpdrdSSdS#t"$rYdSwxYw)uCheap probe — return True when xAI credentials are *likely* usable. Deliberately avoids :func:`resolve_xai_http_credentials` so callers in hot-paint paths (``hermes tools`` repaint, tool-registration scans, ``WebSearchProvider.is_available()``) don't incur disk locks or — in the OAuth path — a network token refresh. The ABC contract on :meth:`agent.web_search_provider.WebSearchProvider.is_available` explicitly forbids network calls for exactly this reason. Resolution order, fast-to-slow: 1. ``XAI_API_KEY`` env var (cheapest; covers explicit-key users). 2. ``~/.hermes/auth.json`` has a non-empty ``providers.xai-oauth.tokens.access_token`` (single file read, no expiry check, no refresh). 3. ``credential_pool.xai-oauth`` has any entry with a non-empty ``access_token`` (covers multi-account ``hermes auth add xai-oauth`` grants that are pool-only / ``manual:device_code``). Returns False on any exception so a corrupted auth store can't block other availability scans. Truthful refresh + expiry handling happens in ``search()`` (or whichever caller actually makes the request). r) get_secret XAI_API_KEYTget_hermes_homez auth.jsonFutf-8encoding providersN xai-oauthtokens access_tokencredential_pool)agent.secret_scoper strip ImportErrorosenvirongethermes_constantsrexistsjsonloads read_text isinstancedictstrlist Exception) r r auth_pathstorer xai_staterrrentriesentrys 4/home/thesage/.hermes/hermes-agent/tools/xai_http.pyhas_xai_credentialsr-s.111111 J}b ) ) /R 6 6 8 8 4   :>>- , , 2 2 4 4 44   444444#O%% 3 !! 5 9...@@AA.8.E.EOEIIk***4 2Return a stable Hermes-specific User-Agent for xAI HTTP calls.r __version__unknownz Hermes-Agent/) hermes_clir7r&r6s r,hermes_xai_user_agentr:_sN *******      (; ( ((s  Dict[str, str]c"dtiS)u5Default headers for OpenAI-SDK and raw HTTP clients talking to xAI. Replaces the OpenAI Python SDK's identifying ``User-Agent: OpenAI/Python …`` so chat/completions and Responses traffic is attributed as Hermes Agent, matching the direct HTTP integrations (search, TTS, STT, image, video). z User-Agent)r:r,hermes_xai_default_headersr?hs /11 22r> section_nameDict[str, Any]c ddlm}|}t|tr||nd}t|tr|niS#t $ricYSwxYw)z=Return a top-level Hermes config section as a dict, or empty.r) load_configN)r1rCr"r#rr&)r@rCcfgsections r,_load_config_sectionrFrs111111kmm+5c4+@+@J#'','''d$Wd33;ww;  sAA A&%A&r4rr2ct|tr|St|tr2|}|dvrdS|dvrdS|S)N>1onyestrueenabledT>0noofffalsedisabledF)r"rr$rlower)r4r2 normalizeds r, _coerce_boolrT~sk% %[[]]((** > > >4 @ @ @5 Nr> Optional[int]c|dSt|trZ|}|dvrdS|dvrdS t |}n#t $r t cYSwxYwt|ttfr,t |}|dkrdSt|tSt S)zNormalize an xAI storage TTL. Returns: int seconds for an expiring file, None for permanent storage (omit expires_after on the wire). N>r r2>rMnonenullneverforever permanentr) r"r$rrRint ValueError&SAFE_XAI_STORAGE_EXPIRES_AFTER_SECONDSfloatmin%MAX_XAI_STORAGE_EXPIRES_AFTER_SECONDS)r4rSsecondss r,_coerce_expires_afterrcs }t% :[[]]((**  ( (4 O O O4 : OOEE : : :9 9 9 9 :%#u&&Ce** a<<47ABBB 11s AA10A1ct|}t|tr|dnd}t|tr|dnd}t|tr|ni}t |dd}t |dd}t |d}|||dS) aRead storage settings for xAI Imagine under image_gen/video_gen config. Supported config shape: image_gen: xai: storage: enabled: true public_url: true expires_after: null # omit for permanent public URLs The same shape is accepted under ``video_gen.xai.storage``. Storage is on by default so xAI returns permanent public URLs instead of short-lived CDN URLs. xaiNstoragerLT public_url expires_after)rLrgrh)rFr"r#rrTrc)r@rE xai_sectionrfrLrgrhs r,read_xai_imagine_storage_configrjs#<00G(27D(A(AK'++e$$$tK,6{D,I,ISkooi(((tG#GT22:ggG7;;y11488Ggkk,77>>J)'++o*F*FGGM &  r>filename_prefix extensionOptional[Dict[str, Any]]ct|}|dsdStjtj}|d}t jjdd}|dpd}|d|d|d|t|dd }|d  |d |d <|S) zAReturn an xAI ``storage_options`` payload, or None when disabled.rLNz %Y%m%d-%H%M%S.bin-rg)filenamergrh) rjdatetimenowUTCstrftimeuuiduuid4hexlstripr) r@rkrlrDrutsshortextpayloads r,build_xai_storage_optionsrs *, 7 7C y>t     - -C o & &B JLL RaR E   3   (5C&;;;;e;;c;;3|,--G ?'#&#7 Nr>ct|}|dsdS|dd}n|ddz }d|dd |d krd nd}d |d |dS)z5User-facing notice for first xAI Imagine storage use.rLr rhNzwithout an automatic expiryiQz for about gz dayszMxAI Imagine storage is enabled so generated media gets a reusable public URL zK. xAI may bill for stored files and public URL hosting. Disable this with `zL.xai.storage.enabled: false` or set `expires_after` to change the retention.)rj)r@rD retentiondayss r,xai_storage_notice_textrs ), 7 7C y>r ?#1 ?#|4GGGGDAIISS2GG  : : :'3 : : :r> Optional[str]ct|}|sdS ddlm}|dz }|dd||dz }|rdS|t jt j dzd |S#t$r|cYSwxYw) zBReturn the storage notice once per Hermes home, then mark it seen.Nrr stateT)parentsexist_ok_xai_storage_notice_seen rr) rrrmkdirr write_textrtrurv isoformatr&)r@noticer marker_dirmarkers r,"maybe_mark_xai_storage_notice_seenrs $\ 2 2F t 444444$_&&0 555GGGG ==?? 4(+// ==GGIIDP[bccc  sAB2AB22 CCF) force_refresh api_key_hintrrc< ddlm}ddlm}|d}|r||n|}|r||}t t|ddpt|dd}t t|ddpt|d dp|j  d }t td ptd pd d }| || } |rd|| dSn#t$rYnwxYw ddlm} | ddt} n@#t $r3t tdpd} YnwxYwt td pd d } d| | dS)u;Resolve bearer credentials for direct xAI HTTP endpoints. Prefers Hermes-managed xAI OAuth credentials when available, then falls back to ``XAI_API_KEY`` resolved via ``hermes_cli.config.get_env_value`` so keys stored in ``~/.hermes/.env`` (the standard Hermes location) are honored — not just ones already exported into ``os.environ``. This keeps direct xAI endpoints (images, TTS, STT, etc.) aligned with the main runtime auth model and preserves the regression contract from PR #17140 / #17163. Set ``force_refresh=True`` to perform an unconditional OAuth refresh. Reactive callers should also pass the rejected bearer as ``api_key_hint`` so a freshly loaded multi-account pool refreshes the exact issuing entry, not whichever entry its strategy would otherwise select first. r) load_poolNrruntime_api_keyrr runtime_base_urlbase_url/HERMES_XAI_BASE_URL XAI_BASE_URL)fallback)providerapi_keyr)resolve_provider_secretr re) env_getterzhttps://api.x.ai/v1)agent.credential_poolrhermes_cli.authauthtry_refresh_matchingselectr$getattrrDEFAULT_XAI_OAUTH_BASE_URLrstripr0 _xai_validate_inference_base_urlr&tools.tool_backend_helpersrr) rrrauth_modpoolr+rfallback_base_urloverride_base_urlrrrs r,resolve_xai_http_credentialsrs&( 333333******y%% D % %l 3 3 3   "U]KKMME E,d 3 3 2unb11   %''  E-t 4 4 3uj"-- 32   %''&&++   / 0 0 ^,,    %''&&++  << &=    ''$        BFFFFFF))-=YYY BBBmM228b99??AAB=00I4IJJPPRRYYZ]^^H  s$E&E** E76E7;F:GG)rr)N)r.r$)rr$)rr;)r@r$rrA)r4rr2rrr)r4rrrU)r@r$rkr$rlr$rrm)r@r$rr$)r@r$rr)rrrrrr;)__doc__ __future__rrtrrrxtypingrrrrar^r-r0r:r?rFrTrcrjrrrrr=r>r,rs66"""""" &&&&&&&&&&):%)9&<<<<~ 3 3 3 3 3 ))))3333        22226>0$* "&HHHHHHHHr>