(Gj(dZddlmZddlZddlZddlZddlZddlmZm Z m Z dZ dZ d$d Z d%d&d Zd'd Zd(dZd)dZd*dZd(dZd+dZd,dZd-dZdd d.d#ZdS)/z0Shared helpers for direct xAI HTTP integrations.) annotationsN)AnyDictOptionali'ireturnboolctjddrdS ddlm}|dz }|sdStj| }t|tr|dnd }t|tr|d nd }t|tr|d nd }t|tr|d nd }tt|pdS#t$rYdSwxYw) uCheap probe — return True when xAI credentials are *likely* usable. Deliberately avoids :func:`resolve_xai_http_credentials` so callers in hot-paint paths (``hermes tools`` repaint, tool-registration scans, ``WebSearchProvider.is_available()``) don't incur disk locks or — in the OAuth path — a network token refresh. The ABC contract on :meth:`agent.web_search_provider.WebSearchProvider.is_available` explicitly forbids network calls for exactly this reason. Resolution order, fast-to-slow: 1. ``XAI_API_KEY`` env var (cheapest; covers explicit-key users). 2. ``~/.hermes/auth.json`` has a non-empty ``providers.xai-oauth.tokens.access_token`` (single file read, no expiry check, no refresh). Returns False on any exception so a corrupted auth store can't block other availability scans. Truthful refresh + expiry handling happens in ``search()`` (or whichever caller actually makes the request). XAI_API_KEYTrget_hermes_homez auth.jsonF providersN xai-oauthtokens access_token)osenvirongetstriphermes_constantsr existsjsonloads read_text isinstancedictrstr Exception)r auth_pathstorer xai_staterrs 4/home/rurouni/.hermes/hermes-agent/tools/xai_http.pyhas_xai_credentialsr#si( z~~mR((..00t 444444#O%% 3 !! 5 9..0011.8.E.EOEIIk***4 2>$ ( ((s  %%c@ ddlm}n#t$rd}YnwxYwd|S)z>Return a stable Hermes-specific User-Agent for xAI HTTP calls.r __version__unknownz Hermes-Agent/) hermes_clir-rr,s r"hermes_xai_user_agentr0HsN *******      (; ( ((s   section_nameDict[str, Any]c ddlm}|}t|tr||nd}t|tr|niS#t $ricYSwxYw)z=Return a top-level Hermes config section as a dict, or empty.r) load_configN)r'r4rrrr)r1r4cfgsections r"_load_config_sectionr7Qs111111kmm+5c4+@+@J#'','''d$Wd33;ww;  sAA A&%A&r*rr(ct|tr|St|tr2|}|dvrdS|dvrdS|S)N>1onyestrueenabledT>0noofffalsedisabledF)rrrrlower)r*r( normalizeds r" _coerce_boolrE]sk% %[[]]((** > > >4 @ @ @5 N Optional[int]c|dSt|trZ|}|dvrdS|dvrdS t |}n#t $r t cYSwxYwt|ttfr,t |}|dkrdSt|tSt S)zNormalize an xAI storage TTL. Returns: int seconds for an expiring file, None for permanent storage (omit expires_after on the wire). N>r r(>r>nonenullneverforever permanentr) rrrrCint ValueError&SAFE_XAI_STORAGE_EXPIRES_AFTER_SECONDSfloatmin%MAX_XAI_STORAGE_EXPIRES_AFTER_SECONDS)r*rDsecondss r"_coerce_expires_afterrUis }t% :[[]]((**  ( (4 O O O4 : OOEE : : :9 9 9 9 :%#u&&Ce** a<<47ABBB 11s AA10A1ct|}t|tr|dnd}t|tr|dnd}t|tr|ni}t |dd}t |dd}t |d}|||dS) aRead storage settings for xAI Imagine under image_gen/video_gen config. Supported config shape: image_gen: xai: storage: enabled: true public_url: true expires_after: null # omit for permanent public URLs The same shape is accepted under ``video_gen.xai.storage``. Storage is on by default so xAI returns permanent public URLs instead of short-lived CDN URLs. xaiNstorager=T public_url expires_after)r=rYrZ)r7rrrrErU)r1r6 xai_sectionrXr=rYrZs r"read_xai_imagine_storage_configr\s#<00G(27D(A(AK'++e$$$tK,6{D,I,ISkooi(((tG#GT22:ggG7;;y11488Ggkk,77>>J)'++o*F*FGGM &  rFfilename_prefix extensionOptional[Dict[str, Any]]ct|}|dsdStjtj}|d}t jjdd}|dpd}|d|d|d|t|dd }|d  |d |d <|S) zAReturn an xAI ``storage_options`` payload, or None when disabled.r=Nz %Y%m%d-%H%M%S.bin-rY)filenamerYrZ) r\datetimenowUTCstrftimeuuiduuid4hexlstripr) r1r]r^r5rgtsshortextpayloads r"build_xai_storage_optionsrrs *, 7 7C y>t     - -C o & &B JLL RaR E   3   (5C&;;;;e;;c;;3|,--G ?'#&#7 NrFct|}|dsdS|dd}n|ddz }d|dd |d krd nd}d |d |dS)z5User-facing notice for first xAI Imagine storage use.r=r rZNzwithout an automatic expiryiQz for about gz dayszMxAI Imagine storage is enabled so generated media gets a reusable public URL zK. xAI may bill for stored files and public URL hosting. Disable this with `zL.xai.storage.enabled: false` or set `expires_after` to change the retention.)r\)r1r5 retentiondayss r"xai_storage_notice_textrys ), 7 7C y>r ?#1 ?#|4GGGGDAIISS2GG  : : :'3 : : :rF Optional[str]ct|}|sdS ddlm}|dz }|dd||dz }|rdS|t jt j dz|S#t$r|cYSwxYw) zBReturn the storage notice once per Hermes home, then mark it seen.Nrr stateT)parentsexist_ok_xai_storage_notice_seen ) ryrr mkdirr write_textrfrgrh isoformatr)r1noticer marker_dirmarkers r""maybe_mark_xai_storage_notice_seenrs $\ 2 2F t 444444$_&&0 555GGGG ==?? 4(+// ==GGIIDPQQQ  sAB0AB00 B?>B?F force_refreshrDict[str, str]c ddlm}||}t|dpd}t|dpdd}|rd||pd d Sn#t $rYnwxYw|s dd lm}|d }t|dpd}t|dpdd}|rd||pd d Sn#t $rYnwxYwttd pd}ttdpd d}d||d S)uResolve bearer credentials for direct xAI HTTP endpoints. Prefers Hermes-managed xAI OAuth credentials when available, then falls back to ``XAI_API_KEY`` resolved via ``hermes_cli.config.get_env_value`` so keys stored in ``~/.hermes/.env`` (the standard Hermes location) are honored — not just ones already exported into ``os.environ``. This keeps direct xAI endpoints (images, TTS, STT, etc.) aligned with the main runtime auth model and preserves the regression contract from PR #17140 / #17163. Set ``force_refresh=True`` to bypass the resolver's JWT-exp shortcut and perform an unconditional OAuth refresh. Callers should use this only as a reactive remediation after a server 401 (mid-window revocation, opaque tokens where the proactive JWT check is a no-op, etc.), not as a default — the auth-store lock is held for the duration of the refresh. r)%resolve_xai_oauth_runtime_credentialsrapi_keyr base_url/rzhttps://api.x.ai/v1)providerrr)resolve_runtime_provider) requestedr XAI_BASE_URLrW) hermes_cli.authrrrrrstriprhermes_cli.runtime_providerrr&)rrcredsrrrruntimers r"resolve_xai_http_credentialsrs4  IIIIII55MRRR599Y//5266<<>> uyy,,23399;;BB3GG  ''$=(=           L L L L L L..EEEGw{{955;<<BBDDL7;;z228b99??AAHHMMH  ++ ( A,A      D - ..4"55;;==G=00I4IJJPPRRYYZ]^^H  s%BB B+*B+1BE EE)rr)N)r$r)rr)r1rrr2)r*rr(rrr)r*rrrG)r1rr]rr^rrr_)r1rrr)r1rrrz)rrrr)__doc__ __future__rrfrrrjtypingrrrrSrPr#r&r0r7rErUr\rrryrrrFr"rsi66"""""" &&&&&&&&&&):%)9&####L)))))$))))        22226>0$&;@55555555rF