JjIdZddlmZddlZddlZddlZddlmZm Z ddl m Z m Z da ddZGd d ZGd d Zd dZd!dZ d"dddd#dZd$dZeZgdZdS)%uProcess-level bootstrap helpers for ``run_agent``. Three concerns, all tied to ``AIAgent`` boot-time / runtime IO setup: 1. **Lazy OpenAI SDK import** — ``_load_openai_cls`` + ``_OpenAIProxy`` defer the 240ms-ish ``from openai import OpenAI`` cost until first use, while preserving ``isinstance(client, OpenAI)`` checks and ``patch("run_agent.OpenAI", ...)`` test patterns. 2. **Crash-resistant stdio** — ``_SafeWriter`` wraps stdout/stderr so ``OSError: Input/output error`` from broken pipes (systemd, Docker, thread teardown races) cannot crash the agent. ``_install_safe_stdio`` applies the wrapper. 3. **HTTP proxy resolution** — ``_get_proxy_from_env`` reads ``HTTPS_PROXY`` / ``HTTP_PROXY`` / ``ALL_PROXY``; ``_get_proxy_for_base_url`` respects ``NO_PROXY`` for the given base URL. ``run_agent`` re-exports every name so existing ``from run_agent import _get_proxy_from_env`` imports keep working unchanged. ) annotationsN)AnyOptional)base_url_hostnamenormalize_proxy_urlreturntypec.tddlm}|atS)z#Import and cache ``openai.OpenAI``.Nr)OpenAI)_OPENAI_CLS_CACHEopenair )_clss =/home/rurouni/.hermes/hermes-agent/agent/process_bootstrap.py_load_openai_clsr's( ))))))  c(eZdZdZdZdZdZdZdS) _OpenAIProxyzHModule-level proxy that looks like ``openai.OpenAI`` but imports lazily.c*t|i|SN)r)selfargskwargss r__call__z_OpenAIProxy.__call__5s!!!426222rc:t|tSr) isinstancer)robjs r__instancecheck__z_OpenAIProxy.__instancecheck__8s#/11222rcdS)Nzrrs r__repr__z_OpenAIProxy.__repr__;s++rN)__name__ __module__ __qualname____doc__ __slots__rrr!rrrrr0sLRRI333333,,,,,rrc:eZdZdZdZdZdZdZdZdZ dZ d S) _SafeWriterupTransparent stdio wrapper that catches OSError/ValueError from broken pipes. When hermes-agent runs as a systemd service, Docker container, or headless daemon, the stdout/stderr pipe can become unavailable (idle timeout, buffer exhaustion, socket reset). Any print() call then raises ``OSError: [Errno 5] Input/output error``, which can crash agent setup or run_conversation() — especially via double-fault when an except handler also tries to print. Additionally, when subagents run in ThreadPoolExecutor threads, the shared stdout handle can close between thread teardown and cleanup, raising ``ValueError: I/O operation on closed file`` instead of OSError. This wrapper delegates all writes to the underlying stream and silently catches both OSError and ValueError. It is transparent when the wrapped stream is healthy. )_innerc>t|d|dS)Nr))object __setattr__)rinners r__init__z_SafeWriter.__init__Ts 4511111rc |j|S#ttf$r)t |t rt |ndcYSwxYw)Nr)r)writeOSError ValueErrorrstrlen)rdatas rr0z_SafeWriter.writeWsb =;$$T** *$ = = = *4 5 5<3t9991 < < < =s7AAcj |jdS#ttf$rYdSwxYwr)r)flushr1r2r s rr7z_SafeWriter.flush]sH  K       $    DD s 22c4|jSr)r)filenor s rr9z_SafeWriter.filenocs{!!###rcf |jS#ttf$rYdSwxYw)NF)r)isattyr1r2r s rr;z_SafeWriter.isattyfsB ;%%'' '$   55 s 00c,t|j|Sr)getattrr))rnames r __getattr__z_SafeWriter.__getattr__lst{D)))rN) r"r#r$r%r&r.r0r7r9r;r?rrrr(r(?s$I222===  $$$ *****rr( Optional[str]cdD]G}tj|d}|rt |cSHdS)zRead proxy URL from environment variables. Checks HTTPS_PROXY, HTTP_PROXY, ALL_PROXY (and lowercase variants) in order. Returns the first valid proxy URL found, or None if no proxy is configured. ) HTTPS_PROXY HTTP_PROXY ALL_PROXY https_proxy http_proxy all_proxyN)osenvirongetstripr)keyvalues r_get_proxy_from_envrOpsZ :.. sB''--//  .&u-- - - - . 4rbase_urlct}|r|s|St|}|s|S tj|rdSn#t $rYnwxYw|S)zFReturn an env-configured proxy unless NO_PROXY excludes this base URL.N)rOrurllibrequestproxy_bypass_environment Exception)rPproxyhosts r_get_proxy_for_base_urlrX~s  ! !E  X & &D   > 2 24 8 8 4        LsA AArHFT) async_modeverifyr3rYboolrZr Optional[Any]cL ddl}t|}|ddd}|dddd }|r|jn|j}|r|jn|j}i} ||| || d } ||||| pd| S#t$rYdSwxYw) aBuild an httpx client for OpenAI SDK calls with env-only proxy policy. Uses explicit ``HTTPS_PROXY`` / ``NO_PROXY`` env vars via ``_get_proxy_for_base_url``. Plain no-proxy mounts disable httpx's default ``trust_env`` proxy path, so macOS system proxy settings from ``urllib.request.getproxies()`` (which omit the ExceptionsList) are not applied. Mirrors ``AIAgent._build_keepalive_http_client``. Connection lifecycle is managed at the HTTP pool layer (``keepalive_expiry=20.0`` reaps idle connections before reverse proxies' typical 30-60 s timeouts) instead of the former custom ``socket_options`` transport, which broke streaming behind reverse proxies (#54049, #12952) and stalled TLS handshakes by stripping ``TCP_NODELAY``. ``verify`` is forwarded to httpx so auxiliary-client calls (compression, vision, web_extract, title generation, etc.) honor the same per-provider ``ssl_ca_cert`` / ``ssl_verify`` and ``HERMES_CA_BUNDLE`` settings the main client uses. It is passed on the client AND on the plain no-proxy mounts (a mounted transport owns the SSL context for its scheme). rNdg4@)max_keepalive_connectionsmax_connectionskeepalive_expiryg.@g$@)connectreadr0pool)rZ)zhttp://zhttps://)limitstimeoutrVmountsrZ) httpxrXLimitsTimeoutAsyncHTTPTransport HTTPTransport AsyncClientClientrU) rPrYrZrirVrfrg transport_cls client_clsrhs rbuild_keepalive_http_clientrrs 6 '11&(!   --4t$-OO4>W00EDW *4FU&&%,  =(=777)M888Fz>T      ttsBB B#"B#NonecdD]R}tt|d}|8t|ts#t t|t|SdS)zHWrap stdout/stderr so best-effort console output cannot crash the agent.)stdoutstderrN)r=sysrr(setattr) stream_namestreams r_install_safe_stdior{s\+;; k400  j&E&E  Ck&&9&9 : : :;;r)r rrr(r{rOrXrr)rr )rr@)rPr@rr@)rH)rPr3rYr[rZrrr\)rrs)r% __future__rrIrwurllib.requestrRtypingrrutilsrrr rrr(rOrXrrr{r __all__rrrrsm.#"""""  88888888  , , , , , , , ,.*.*.*.*.*.*.*.*b    (8 888888v;;;;    r