`gjIdZddlmZddlZddlZddlZddlmZm Z ddl m Z m Z da ddZGddZGd d Zdd Zdd Z dd dd ddZddZeZgdZy)uProcess-level bootstrap helpers for ``run_agent``. Three concerns, all tied to ``AIAgent`` boot-time / runtime IO setup: 1. **Lazy OpenAI SDK import** — ``_load_openai_cls`` + ``_OpenAIProxy`` defer the 240ms-ish ``from openai import OpenAI`` cost until first use, while preserving ``isinstance(client, OpenAI)`` checks and ``patch("run_agent.OpenAI", ...)`` test patterns. 2. **Crash-resistant stdio** — ``_SafeWriter`` wraps stdout/stderr so ``OSError: Input/output error`` from broken pipes (systemd, Docker, thread teardown races) cannot crash the agent. ``_install_safe_stdio`` applies the wrapper. 3. **HTTP proxy resolution** — ``_get_proxy_from_env`` reads ``HTTPS_PROXY`` / ``HTTP_PROXY`` / ``ALL_PROXY``; ``_get_proxy_for_base_url`` respects ``NO_PROXY`` for the given base URL. ``run_agent`` re-exports every name so existing ``from run_agent import _get_proxy_from_env`` imports keep working unchanged. ) annotationsN)AnyOptional)base_url_hostnamenormalize_proxy_urlc*tddlm}|atS)z#Import and cache ``openai.OpenAI``.r)OpenAI)_OPENAI_CLS_CACHEopenair )_clss J/root/.hermes/venv/lib/python3.12/site-packages/agent/process_bootstrap.py_load_openai_clsr's )  c&eZdZdZdZdZdZdZy) _OpenAIProxyzHModule-level proxy that looks like ``openai.OpenAI`` but imports lazily.c"t|i|SN)r)selfargskwargss r __call__z_OpenAIProxy.__call__5s!!42622rc*t|tSr) isinstancer)robjs r __instancecheck__z_OpenAIProxy.__instancecheck__8s#/122rcy)Nzrrs r __repr__z_OpenAIProxy.__repr__;s+rN)__name__ __module__ __qualname____doc__ __slots__rrrrrr rr0sRI33,rrc8eZdZdZdZdZdZdZdZdZ dZ y ) _SafeWriterupTransparent stdio wrapper that catches OSError/ValueError from broken pipes. When hermes-agent runs as a systemd service, Docker container, or headless daemon, the stdout/stderr pipe can become unavailable (idle timeout, buffer exhaustion, socket reset). Any print() call then raises ``OSError: [Errno 5] Input/output error``, which can crash agent setup or run_conversation() — especially via double-fault when an except handler also tries to print. Additionally, when subagents run in ThreadPoolExecutor threads, the shared stdout handle can close between thread teardown and cleanup, raising ``ValueError: I/O operation on closed file`` instead of OSError. This wrapper delegates all writes to the underlying stream and silently catches both OSError and ValueError. It is transparent when the wrapped stream is healthy. )_innerc2tj|d|y)Nr')object __setattr__)rinners r __init__z_SafeWriter.__init__Ts451rc |jj|S#ttf$r"t |t r t |cYSdcYSwxYw)Nr)r'writeOSError ValueErrorrstrlen)rdatas r r.z_SafeWriter.writeWsH =;;$$T* *$ = *4 53t9 <1 < =s*A A Acd |jjy#ttf$rYywxYwr)r'flushr/r0rs r r5z_SafeWriter.flush]s.  KK   $   s //c6|jjSr)r'filenors r r7z_SafeWriter.filenocs{{!!##rcb |jjS#ttf$rYywxYw)NF)r'isattyr/r0rs r r9z_SafeWriter.isattyfs1 ;;%%' '$  s ..c.t|j|Sr)getattrr')rnames r __getattr__z_SafeWriter.__getattr__lst{{D))rN) r r!r"r#r$r,r.r5r7r9r=rrr r&r&?s,$I2=  $ *rr&cdD]?}tjj|dj}|s4t |cSy)zRead proxy URL from environment variables. Checks HTTPS_PROXY, HTTP_PROXY, ALL_PROXY (and lowercase variants) in order. Returns the first valid proxy URL found, or None if no proxy is configured. ) HTTPS_PROXY HTTP_PROXY ALL_PROXY https_proxy http_proxy all_proxyN)osenvirongetstripr)keyvalues r _get_proxy_from_envrLpsC :. sB'--/ &u- - . rct}|r|s|St|}|s|S tjj |ry |S#t $rY|SwxYw)zFReturn an env-configured proxy unless NO_PROXY excludes this base URL.N)rLrurllibrequestproxy_bypass_environment Exception)base_urlproxyhosts r _get_proxy_for_base_urlrU~se  !E  X &D   >> 2 24 8 9 L   L sA AAFT) async_modeverifycJ ddl}t|}|jddd}|jdddd }|r |jn |j }|r |j n |j}i} ||| || d } ||||| xsd| S#t$rYywxYw) aBuild an httpx client for OpenAI SDK calls with env-only proxy policy. Uses explicit ``HTTPS_PROXY`` / ``NO_PROXY`` env vars via ``_get_proxy_for_base_url``. Plain no-proxy mounts disable httpx's default ``trust_env`` proxy path, so macOS system proxy settings from ``urllib.request.getproxies()`` (which omit the ExceptionsList) are not applied. Mirrors ``AIAgent._build_keepalive_http_client``. Connection lifecycle is managed at the HTTP pool layer (``keepalive_expiry=20.0`` reaps idle connections before reverse proxies' typical 30-60 s timeouts) instead of the former custom ``socket_options`` transport, which broke streaming behind reverse proxies (#54049, #12952) and stalled TLS handshakes by stripping ``TCP_NODELAY``. ``verify`` is forwarded to httpx so auxiliary-client calls (compression, vision, web_extract, title generation, etc.) honor the same per-provider ``ssl_ca_cert`` / ``ssl_verify`` and ``HERMES_CA_BUNDLE`` settings the main client uses. It is passed on the client AND on the plain no-proxy mounts (a mounted transport owns the SSL context for its scheme). rNdg4@)max_keepalive_connectionsmax_connectionskeepalive_expiryg.@g$@)connectreadr.pool)rW)zhttp://zhttps://)limitstimeoutrSmountsrW) httpxrULimitsTimeoutAsyncHTTPTransport HTTPTransport AsyncClientClientrQ) rRrVrWrdrSrarb transport_cls client_clsrcs r build_keepalive_http_clientrms6'1&(!  --4t$-O4>00EDWDW *4U&&%,,  =(7)8F>T    sBB B"!B"cdD]A}tt|d}|t|tr(t t|t|Cy)zHWrap stdout/stderr so best-effort console output cannot crash the agent.)stdoutstderrN)r;sysrr&setattr) stream_namestreams r _install_safe_stdiorus?+; k40  j&E Ck&&9 :;r)r rrr&rurLrUrm)returntype)rv Optional[str])rRrxrvrx)rE)rRr1rVboolrWrrvz Optional[Any])rvNone)r# __future__rrFrqurllib.requestrNtypingrrutilsrrr rrr&rLrUrmrur __all__rrr rs.#  8  , ,.*.*b (8 888  8  8v;  r