`gj,dZddlmZddlZddlZddlZddlZddlmZm Z m Z dZ dZ ddZ dddZdd Zdd Zdd Zdd Zdd Z ddZddZddZddd ddZy)z0Shared helpers for direct xAI HTTP integrations.) annotationsN)AnyDictOptionali'ictjjddjry ddlm}|dz }|j sytj|j}t|tr|jdnd }t|tr|jd nd }t|tr|jd nd }t|tr|jd nd }t|xsdjryt|tr|jd nd }t|tr|jd nd }t|trG|D]B} t| tst| jd dxsdjsByy#t$rYywxYw)uCheap probe — return True when xAI credentials are *likely* usable. Deliberately avoids :func:`resolve_xai_http_credentials` so callers in hot-paint paths (``hermes tools`` repaint, tool-registration scans, ``WebSearchProvider.is_available()``) don't incur disk locks or — in the OAuth path — a network token refresh. The ABC contract on :meth:`agent.web_search_provider.WebSearchProvider.is_available` explicitly forbids network calls for exactly this reason. Resolution order, fast-to-slow: 1. ``XAI_API_KEY`` env var (cheapest; covers explicit-key users). 2. ``~/.hermes/auth.json`` has a non-empty ``providers.xai-oauth.tokens.access_token`` (single file read, no expiry check, no refresh). 3. ``credential_pool.xai-oauth`` has any entry with a non-empty ``access_token`` (covers multi-account ``hermes auth add xai-oauth`` grants that are pool-only / ``manual:device_code``). Returns False on any exception so a corrupted auth store can't block other availability scans. Truthful refresh + expiry handling happens in ``search()`` (or whichever caller actually makes the request). XAI_API_KEYTrget_hermes_homez auth.jsonF providersN xai-oauthtokens access_tokencredential_pool)osenvirongetstriphermes_constantsr existsjsonloads read_text isinstancedictstrlist Exception) r auth_pathstorer xai_staterrrentriesentrys A/root/.hermes/venv/lib/python3.12/site-packages/tools/xai_http.pyhas_xai_credentialsr%s. zz~~mR(..04#% 3 ! 9..01.8.EEIIk*4 2>$ ((    s5 AAc< ddlm}d|S#t$rd}YwxYw)z>Return a stable Hermes-specific User-Agent for xAI HTTP calls.r __version__unknownz Hermes-Agent/) hermes_clir/rr.s r$hermes_xai_user_agentr2[s/ *;- ((    s  c ddlm}|}t|tr|j |nd}t|tr|SiS#t $ricYSwxYw)z=Return a top-level Hermes config section as a dict, or empty.r) load_configN)r(r4rrrr) section_namer4cfgsections r$_load_config_sectionr8dsR1m+5c4+@#'','d$Wd3w;;  sAAA AAct|tr|St|tr(|jj }|dvry|dvry|S)N>1onyestrueenabledT>0noofffalsedisabledF)rboolrrlower)r,r* normalizeds r$ _coerce_boolrGpsL% %[[]((* > > @ @ Nc4|yt|tr4|jj}|dvry|dvry t |}t|ttfr!t |}|dkryt|tSt S#t $r t cYSwxYw)zNormalize an xAI storage TTL. Returns: int seconds for an expiring file, None for permanent storage (omit expires_after on the wire). N>r r*>r?nonenullneverforever permanentr) rrrrEint ValueError&SAFE_XAI_STORAGE_EXPIRES_AFTER_SECONDSfloatmin%MAX_XAI_STORAGE_EXPIRES_AFTER_SECONDS)r,rFsecondss r$_coerce_expires_afterrV|s }%[[]((*  ( O O : OE%#u&e* a<7ABB 11 :9 9 :s BBBcxt|}t|tr|jdnd}t|tr|jdnd}t|tr|ni}t |jdd}t |jdd}t |jd}|||dS) aRead storage settings for xAI Imagine under image_gen/video_gen config. Supported config shape: image_gen: xai: storage: enabled: true public_url: true expires_after: null # omit for permanent public URLs The same shape is accepted under ``video_gen.xai.storage``. Storage is on by default so xAI returns permanent public URLs instead of short-lived CDN URLs. xaiNstorager>T public_url expires_after)r>rZr[)r8rrrrGrV)r5r7 xai_sectionrYr>rZr[s r$read_xai_imagine_storage_configr]s#<0G(27D(A'++e$tK,6{D,Ikooi(tG#GT2gG7;;y148Ggkk,7>J)'++o*FGM & rHcbt|}|dsytjjtj}|j d}t j jdd}|jdxsd}|d|d|d|t|dd }|d |d |d <|S) zAReturn an xAI ``storage_options`` payload, or None when disabled.r>Nz %Y%m%d-%H%M%S.bin-rZ)filenamerZr[) r]datetimenowUTCstrftimeuuiduuid4hexlstriprD) r5filename_prefix extensionr6retsshortextpayloads r$build_xai_storage_optionsrrs *, 7C y>      -C o &B JJL  Ra E   3  (5C&'qAeWAcU;3|,-G ?'#&#7 NrHcvt|}|dsy|dd}n|ddz }d|dd|d k7rd nd}d |d |d S)z5User-facing notice for first xAI Imagine storage use.r>r r[zwithout an automatic expiryiQz for about gz dayszMxAI Imagine storage is enabled so generated media gets a reusable public URL zK. xAI may bill for stored files and public URL hosting. Disable this with `zL.xai.storage.enabled: false` or set `expires_after` to change the retention.)r])r5r6 retentiondayss r$xai_storage_notice_textrysu ), 7C y> ?#1 ?#|4 aDAIS2,FG  [!''3n5: :rHcXt|}|sy ddlm}|dz }|jdd||dz }|j ry|j t j jt jjdz|S#t$r|cYSwxYw) zBReturn the storage notice once per Hermes home, then mark it seen.Nrr stateT)parentsexist_ok_xai_storage_notice_seen ) ryrr mkdirr write_textrdrerf isoformatr)r5noticer marker_dirmarkers r$"maybe_mark_xai_storage_notice_seenrs $\ 2F  4$&0 5.FGG ==?(++// =GGIDPQ  s;B AB B)(B)F) force_refresh api_key_hintc< ddlm}ddlm}|d}|r|j |n|j }|r||j }t t|ddxs t|ddj}t t|ddxst|d dxs |jjjd }t td xstd xsdjjd }|j|| } |rd|| dS t tdxsdj} t td xsdjjd } d| | dS#t$rYlwxYw)u;Resolve bearer credentials for direct xAI HTTP endpoints. Prefers Hermes-managed xAI OAuth credentials when available, then falls back to ``XAI_API_KEY`` resolved via ``hermes_cli.config.get_env_value`` so keys stored in ``~/.hermes/.env`` (the standard Hermes location) are honored — not just ones already exported into ``os.environ``. This keeps direct xAI endpoints (images, TTS, STT, etc.) aligned with the main runtime auth model and preserves the regression contract from PR #17140 / #17163. Set ``force_refresh=True`` to perform an unconditional OAuth refresh. Reactive callers should also pass the rejected bearer as ``api_key_hint`` so a freshly loaded multi-account pool refreshes the exact issuing entry, not whichever entry its strategy would otherwise select first. r) load_poolNr runtime_api_keyrr runtime_base_urlbase_url/HERMES_XAI_BASE_URL XAI_BASE_URL)fallback)providerapi_keyrrzhttps://api.x.ai/v1rX)agent.credential_poolrhermes_cli.authauthtry_refresh_matchingselectrgetattrrDEFAULT_XAI_OAUTH_BASE_URLrstripr' _xai_validate_inference_base_urlr) rrrauth_modpoolr#rfallback_base_urloverride_base_urlrrs r$resolve_xai_http_credentialsrs&( 3*%  % %l 3  U]KKME E,d 3 2unb1  %'  E-t 4 3uj"- 322  %'&&+   / 0 ^,   %'&&+  << &=  ''$  - .4"5;;=G=0I4IJPPRYYZ]^H     sD*F FF)returnrD)N)r)r)rr)r5rrzDict[str, Any])r,rr*rDrrD)r,rrz Optional[int])r5rrlrrmrrzOptional[Dict[str, Any]])r5rrr)r5rr Optional[str])rrDrrrzDict[str, str])__doc__ __future__rrdrrrhtypingrrrrTrQr%r'r2r8rGrVr]rrryrrrHr$rs6" &&):%)9&6r)$)  26>   0$* "&CC C CrH