`gjgAdZddlmZddlZddlZddlZddlmZmZddl m Z m Z m Z ddl mZddlmZmZddlmZdd lmZej.eZd Zd ZeGd d Z d ddZ ddZ ddd ddZddZ d dZ!d!dZ"dd d"dZ#dd d#dZ$ d$dd d%dZ% d$dd d&dZ&gdZ'y)'uAzure Foundry endpoint auto-detection. Inspect a Microsoft Foundry / Azure OpenAI endpoint to determine: - API transport (OpenAI-style ``chat_completions`` vs Anthropic-style ``anthropic_messages``) - Available models (best effort — Azure does not expose a deployment listing via the inference API key, but Azure OpenAI v1 endpoints return the resource's model catalog via ``GET /models``) - Context length for each discovered/entered model, via the existing :func:`agent.model_metadata.get_model_context_length` resolver. Rationale: Azure has no pure-API-key deployment-listing endpoint — per Microsoft, deployment enumeration requires ARM management-plane auth. Azure OpenAI v1 endpoints ``{resource}.openai.azure.com/openai/v1`` do return a ``/models`` list, but it reflects the resource's *available* models rather than the user's *deployed* deployment names. In practice it is still a useful hint — the user picks a familiar model name and we look up its context length from the catalog. Authentication modes: - ``api_key`` (default): the wizard passes an ``api_key`` string; the probe sends both ``api-key:`` and ``Authorization: Bearer`` headers so we hit any Azure deployment regardless of which header it expects. - ``entra_id``: the wizard passes a ``token_provider`` callable from :mod:`agent.azure_identity_adapter`. The probe mints exactly one bearer JWT, sends **only** ``Authorization: Bearer `` (never ``api-key:``), and never persists the token. This matches Microsoft's documented contract for keyless inference. The detector never crashes on errors (every HTTP call is wrapped in a broad try/except). Callers get a :class:`DetectionResult` with whatever information could be gathered, and fall back to manual entry for the rest. ) annotationsN) dataclassfield)AnyCallableOptional)request) HTTPErrorURLError)urlparse)open_credentialed_url)z2025-04-01-previewz 2024-10-21z 2025-04-15cteZdZUdZdZded<eeZded<dZ d ed <dZ d ed <d Z d ed<d Z d ed<y)DetectionResultzAEverything auto-detection could gather from a base URL + API key.N Optional[str]api_mode)default_factory list[str]modelsstrhostnamereasonFboolmodels_probe_ok is_anthropic) __name__ __module__ __qualname____doc__r__annotations__rlistrrrrrJ/root/.hermes/venv/lib/python3.12/site-packages/hermes_cli/azure_detect.pyrrCsRK#Hm"d3FI3HcFC"OT!L$r#rc|&t|r |}|r t|dfSddfSt|r+t |ts |}|r t|dfSddfSt |tr|r|dfSy#t$r }tj d|Yd}~yd}~wwxYw#t$r }tj d|Yd}~yd}~wwxYw)uCoerce wizard inputs into a (token, mode) pair. Returns ``(token_or_None, mode)`` where ``mode`` is: - ``"entra_id"`` when a callable token provider was supplied — the returned token is a freshly minted bearer JWT, sent ONLY in ``Authorization: Bearer``. - ``"api_key"`` when a string key was supplied — the returned token is the raw API key, sent in BOTH ``api-key:`` and ``Authorization: Bearer`` headers (preserves the original broad-compat probe behaviour). - ``("", "api_key")`` when neither yields a value. Bearer minting failures degrade to ``("", "entra_id")`` so the caller can still report "detection incomplete" rather than crashing. Nentra_idz'azure_detect: token_provider failed: %s)Nr&z)azure_detect: api_key callable failed: %sapi_key)Nr')callabler Exceptionloggerdebug isinstance)r'token_providertokenexcs r$_resolve_credentialr0^s&!h~&> $"$E"'CJJ> >TJ> >GS!9 $IE"'CJJ> >TJ> > '3G !!  $ LLBC H# $ $ LLDc J# $s:A6A6B"B"6 B?BB" C +CC c|sy|dk(r|jdd|y|jd||jdd|y)zBAttach the right auth headers to ``req`` based on credential mode.Nr& AuthorizationzBearer zapi-key) add_header)reqr.modes r$_apply_auth_headersr6sN  z '%(9: y%( '%(9:r#r-ct||\}}tj|d}t||||j dd t ||5}|j } |jtj|jddfcd d d S#t$r|jd fcYcd d d SwxYw#1swYy xYw#t$r} | jd fcYd } ~ Sd } ~ wttt f$r!} t"j%d || Yd } ~ y d } ~ wt$r!} t"j%d || Yd } ~ y d } ~ wwxYw) zoGET a URL with the appropriate auth headers. Return ``(status_code, parsed_json_or_None)``. Never raises.GET)method User-Agenthermes-agent/azure-detecttimeoututf-8replaceerrorsNzazure_detect: GET %s failed: %s)rNz)azure_detect: GET %s unexpected error: %s)r0urllib_requestRequestr6r3r readstatusjsonloadsdecoder)r coder TimeoutErrorOSErrorr*r+) urlr'r>r-r.r5r4respbodyr/s r$_http_get_jsonrPs(&g~>KE4  U 3CUD)NN/models`` for an OpenAI-shaped response. Returns ``(ok, models)``. ``ok`` is True iff the endpoint accepted us as an OpenAI-style caller (200 OK + OpenAI-shaped JSON body). rRz/modelsz/models?api-version=r7z0azure_detect: /models probe OK at %s (%d models)Tr^F) rU _AZURE_OPENAI_PROBE_API_VERSIONSrdrPrir*infolenr,rb) base_urlr'r- candidatesvrMrFrOrfs r$_probe_openai_modelsrrss#HJg&'J -@XJ&:1#>?@  %c7>R  S=T-$T*C FSSy $%&D.Rx   "9r#ct|}|dt}tjdddddgdj d}t j |d | }t||\}}t||||jd d |jd d|jdd t|d5} | jdkcdddS#1swYyxYw#t$r|} | jjdd} | j} d| vsd| vr d| vrYd} ~ y| j dk(r d| vsd| vrYd} ~ yYd} ~ y#t"$rYYd} ~ ywxYwd} ~ wt$t&t(f$rYyt"$rYywxYw)a'Send a zero-token request to ``/v1/messages`` and check whether the endpoint at least *recognises* the Anthropic Messages shape (any 4xx that mentions ``messages`` or ``model``, or a 400 ``invalid_request`` with an Anthropic error shape). Never completes a real chat. z/v1/messages?api-version=probeuserping)rolecontent)r` max_tokensmessagesr?POST)r:r^zanthropic-versionz 2023-06-01z content-typezapplication/jsonr;r<@r=iNr@rA anthropicz"type"z"error"Tir{r`F)rV_AZURE_ANTHROPIC_API_VERSIONrGdumpsencoderCrDr0r6r3r rFr rErIrYrJr)r rKrL) ror'r-baserMrer4r.r5rNr/rOlowereds r$_probe_anthropic_messagesrs h 'D F+,H+I JCjj$89vg   V' BC%g~>KE4UD)NN& 5NN>#56NNR".C   K M MO s.CC&%C&cFt|xsdj}|sy ddlm}m}t ||\}}|xsd} |||| } t| tr | dkDr| |k7r| Sy#t $rYywxYw#t $r } tjd| Yd} ~ yd} ~ wwxYw)uCThin wrapper around :func:`agent.model_metadata.get_model_context_length` that returns ``None`` when only the fallback default (128k) would fire, so the wizard can distinguish "we actually know this" from "we guessed. For Entra-ID mode pass a callable as ``api_key`` (or via ``token_provider=``); the wrapped resolver expects a string, so we mint one bearer JWT here for the single lookup. The resolver itself only reads catalog metadata over HTTP — no SDK client is built — so the minted token is consumed for at most one /models probe. rNr)DEFAULT_FALLBACK_CONTEXTget_model_context_length)ror'z.azure_detect: context length lookup failed: %s) rstripagent.model_metadatarrr)r0r*r+r,int) r`ror'r-model_idrrr.r5 effective_keynr/s r$lookup_context_lengthrls"5;B%%'H  &g~>KE4KRM $X- X !Sa!e-E(E !   EsKs)A( A7( A43A47 B BB )rrr)N)r'rr-Optional[Callable[[], str]]returnztuple[Optional[str], str])r4zurllib_request.Requestr.rr5rrNone)r}) rMrr'rr>floatr-rrztuple[int, Optional[dict]])rMrrr)rMrrr)rerbrr)rorr'rr-rrztuple[bool, list[str]])rorr'rr-rrr)r)rorr'rr-rrr) r`rrorr'rr-rrz Optional[int])(r __future__rrGloggingrS dataclassesrrtypingrrrurllibr rC urllib.errorr r urllib.parser hermes_cli.urllib_securityr getLoggerrr*rlrrr0r6rPrVr\rirrrrr__all__r"r#r$rs#J#  (**,,!<   8 $ $  ,  6GK$(C$6$N;,;!;&*;&%(BF !$?  3 :2 (HL!"%!*E!5 !NMQ/'*//J/$( /f>:>>>7> >F*,)IM )$')#&)+F ) - )X Ar#