
    j                    6   d Z ddlmZ ddlZddlZddlZddlmZmZ ddlm	Z	 ddl
mZmZ  ej        e          ZddlmZ ddlmZ d	Zd
ZdZ e	d           G d d                      Zd Zd+dZd,dZd-dZd.dZd.dZd/d!Zd0d#Z	 	 d1d2d)Z 	 	 d1d3d*Z!dS )4zIGeneric managed-tool gateway helpers for Nous-hosted vendor passthroughs.    )annotationsN)datetimetimezone)	dataclass)CallableOptionalget_hermes_home)managed_nous_tools_enabledznousresearch.comhttpsx   T)frozenc                  8    e Zd ZU ded<   ded<   ded<   ded<   dS )ManagedToolGatewayConfigstrvendorgateway_originnous_user_tokenboolmanaged_modeN)__name__
__module____qualname____annotations__     ?/home/ubuntu/.hermes/hermes-agent/tools/managed_tool_gateway.pyr   r      s?         KKKr   r   c                 $    t                      dz  S )zDReturn the Hermes auth store path, respecting HERMES_HOME overrides.z	auth.jsonr	   r   r   r   auth_json_pathr      s    {**r   returnOptional[dict]c                 r   	 t                      } |                                 sd S t          j        |                                           }|                    di           }t          |t                    sd S |                    di           }t          |t                    r|S n# t          $ r Y nw xY wd S )N	providersnous)	r   is_filejsonloads	read_textget
isinstancedict	Exception)pathdatar#   nous_providers       r   _read_nous_provider_stater0   #   s    ||~~ 	4z$..**++HH["--	)T** 	4!fb11mT** 	!  	!   4s   "B' AB' 9,B' '
B43B4valueobjectOptional[datetime]c                   t          | t                    r|                                 sd S |                                 }|                    d          r|d d         dz   }	 t	          j        |          }n# t          $ r Y d S w xY w|j         |                    t          j
                  }|                    t          j
                  S )NZz+00:00)tzinfo)r*   r   stripendswithr   fromisoformat
ValueErrorr7   replacer   utc
astimezone)r1   
normalizedparseds      r   _parse_timestamprA   4   s    eS!!  tJ3 0_x/
'
33   tt}x|44X\***s   #A8 8
BB
expires_atskew_secondsintr   c                    t          |           }|dS |t          j        t          j                  z
                                  }|t          dt          |                    k    S )NTr   )rA   r   nowr   r=   total_secondsmaxrD   )rB   rC   expires	remainings       r   _access_token_is_expiringrK   C   sX    z**Gt8<555DDFFIAs<001111r   Optional[str]c                 l   t          j        d          } t          | t                    r(|                                 r|                                 S t                      pi }|                    d          }t          |t                    r(|                                r|                                S dS )a  Cheap probe for a Nous gateway token without triggering refresh.

    Availability scans (`hermes tools`, banner/status paint, provider
    `is_available()` checks) must stay off the synchronous OAuth refresh path.
    This helper therefore only inspects the explicit env override and the
    cached auth-store token, without checking expiry and without making any
    network calls. Truthful refresh handling stays in request/session paths
    that call :func:`read_nous_access_token`.
    TOOL_GATEWAY_USER_TOKENaccess_tokenN)osgetenvr*   r   r8   r0   r)   )explicitr/   rO   s      r   peek_nous_access_tokenrS   K   s     y233H(C    X^^%5%5  ~~-//52M $$^44L,$$ $););)=)= $!!###4r   c                 L   t          j        d          } t          | t                    r(|                                 r|                                 S t                      pi }t                      }|r*t          |                    d          t                    s|S 	 ddl
m}  |t                    }t          |t                    r(|                                r|                                S n2# t          $ r%}t                              d|           Y d}~nd}~ww xY w|S )zJRead a Nous Subscriber OAuth access token from auth store or env override.rN   rB   r   )resolve_nous_access_token)refresh_skew_secondsz$Nous access token refresh failed: %sN)rP   rQ   r*   r   r8   r0   rS   rK   r)   '_NOUS_ACCESS_TOKEN_REFRESH_SKEW_SECONDShermes_cli.authrU   r,   loggerdebug)rR   r/   cached_tokenrU   refreshed_tokenexcs         r   read_nous_access_tokenr^   `   sQ   y233H(C    X^^%5%5  ~~-//52M)++L 5,''/   	B======33!H
 
 
 os++ 	+0E0E0G0G 	+"((*** B B B;SAAAAAAAAB s   AC2 2
D!<DD!r   c                     t          j        dd                                                                          } | st          S | dv r| S t          d          )z,Return configured shared gateway URL scheme.TOOL_GATEWAY_SCHEME >   httpr   z-TOOL_GATEWAY_SCHEME must be 'http' or 'https')rP   rQ   r8   lower_DEFAULT_TOOL_GATEWAY_SCHEMEr;   )schemes    r   get_tool_gateway_schemerf   |   sZ    Y,b117799??AAF ,++"""
D
E
EEr   r   c                   |                                                      dd           d}t          j        |d                                                              d          }|r|S t                      }t          j        dd                                                              d          }|r
| d|  d| S | d|  dt           S )	z0Return the gateway origin for a specific vendor.-__GATEWAY_URLra   /TOOL_GATEWAY_DOMAINz://z	-gateway.)upperr<   rP   rQ   r8   rstriprf   _DEFAULT_TOOL_GATEWAY_DOMAIN)r   
vendor_keyexplicit_vendor_urlshared_schemeshared_domains        r   build_vendor_gateway_urlrt      s    LLNN**344BBBJ)J3399;;BB3GG #""+--MI3R88>>@@FFsKKM EDDFDD]DDDOOOO1MOOOr   gateway_builderOptional[Callable[[str], str]]token_reader%Optional[Callable[[], Optional[str]]]"Optional[ManagedToolGatewayConfig]c                    t                      sdS |pt          }|pt          } ||           } |            }|r|sdS t          | ||d          S )z8Resolve shared managed-tool gateway config for a vendor.NT)r   r   r   r   )r   rt   r^   r   )r   ru   rw   resolved_gateway_builderresolved_token_readerr   r   s          r   resolve_managed_tool_gatewayr}      s     &'' t.J2J(B,B--f55N++--O  t#%'	   r   c                8    t          | ||pt                    duS )a|  Return True when gateway URL and a likely-usable Nous token are present.

    Defaults to :func:`peek_nous_access_token` so read-only availability scans
    avoid synchronous OAuth refresh. Callers that are about to make a real
    gateway request should use :func:`resolve_managed_tool_gateway` (which
    still defaults to the refresh-aware :func:`read_nous_access_token`).
    )ru   rw   N)r}   rS   )r   ru   rw   s      r   is_managed_tool_gateway_readyr      s4     ('!;%;   	 r   )r    r!   )r1   r2   r    r3   )rB   r2   rC   rD   r    r   )r    rL   )r    r   )r   r   r    r   )NN)r   r   ru   rv   rw   rx   r    ry   )r   r   ru   rv   rw   rx   r    r   )"__doc__
__future__r   r&   loggingrP   r   r   dataclassesr   typingr   r   	getLoggerr   rY   hermes_constantsr
   tools.tool_backend_helpersr   ro   rd   rW   r   r   r0   rA   rK   rS   r^   rf   rt   r}   r   r   r   r   <module>r      s   O O " " " " " "   				 ' ' ' ' ' ' ' ' ! ! ! ! ! ! % % % % % % % %		8	$	$ , , , , , , A A A A A A1 & *- ' $       + + +
   "+ + + +2 2 2 2   *   8	F 	F 	F 	FP P P P" 7;:>    6 7;:>      r   