ۘjZdZddlmZddlZddlZddlmZddZddd Zdd Z d d ddZ dS)z0Shared helpers for direct xAI HTTP integrations.) annotationsN)DictreturnboolctjddrdS ddlm}|dz }|sdStj| }t|tr|dnd }t|tr|d nd }t|tr|d nd }t|tr|d nd }tt|pdS#t$rYdSwxYw) uCheap probe — return True when xAI credentials are *likely* usable. Deliberately avoids :func:`resolve_xai_http_credentials` so callers in hot-paint paths (``hermes tools`` repaint, tool-registration scans, ``WebSearchProvider.is_available()``) don't incur disk locks or — in the OAuth path — a network token refresh. The ABC contract on :meth:`agent.web_search_provider.WebSearchProvider.is_available` explicitly forbids network calls for exactly this reason. Resolution order, fast-to-slow: 1. ``XAI_API_KEY`` env var (cheapest; covers explicit-key users). 2. ``~/.hermes/auth.json`` has a non-empty ``providers.xai-oauth.tokens.access_token`` (single file read, no expiry check, no refresh). Returns False on any exception so a corrupted auth store can't block other availability scans. Truthful refresh + expiry handling happens in ``search()`` (or whichever caller actually makes the request). XAI_API_KEYTr)get_hermes_homez auth.jsonF providersN xai-oauthtokens access_token)osenvirongetstriphermes_constantsr existsjsonloads read_text isinstancedictrstr Exception)r auth_pathstorer xai_stater rs 3/home/ubuntu/.hermes/hermes-agent/tools/xai_http.pyhas_xai_credentialsr si( z~~mR((..00t 444444#O%% 3 !! 5 9..0011.8.E.EOEIIk***4 2>$ ( ((s  %%c@ ddlm}n#t$rd}YnwxYwd|S)z>Return a stable Hermes-specific User-Agent for xAI HTTP calls.r __version__unknownz Hermes-Agent/) hermes_clir*rr)s rhermes_xai_user_agentr-BsN *******      (; ( ((s  F force_refreshr/Dict[str, str]c|s ddlm}|d}t|dpd}t|dpdd}|rd||pd d Sn#t $rYnwxYw dd lm}|| }t|dpd}t|dpdd}|rd||pd d Sn#t $rYnwxYwttd pd}ttdpd d}d||d S)uResolve bearer credentials for direct xAI HTTP endpoints. Prefers Hermes-managed xAI OAuth credentials when available, then falls back to ``XAI_API_KEY`` resolved via ``hermes_cli.config.get_env_value`` so keys stored in ``~/.hermes/.env`` (the standard Hermes location) are honored — not just ones already exported into ``os.environ``. This keeps direct xAI endpoints (images, TTS, STT, etc.) aligned with the main runtime auth model and preserves the regression contract from PR #17140 / #17163. Set ``force_refresh=True`` to bypass the resolver's JWT-exp shortcut and perform an unconditional OAuth refresh. Callers should use this only as a reactive remediation after a server 401 (mid-window revocation, opaque tokens where the proactive JWT check is a no-op, etc.), not as a default — the auth-store lock is held for the duration of the refresh. r)resolve_runtime_providerr ) requestedapi_keyr base_url/zhttps://api.x.ai/v1)providerr4r5)%resolve_xai_oauth_runtime_credentialsr.r XAI_BASE_URLxai) hermes_cli.runtime_providerr2rrrrstriprhermes_cli.authr8r#)r/r2runtimerr5r8credsr4s rresolve_xai_http_credentialsr@Ks4   L L L L L L..EEEGw{{955;<<BBDDL7;;z228b99??AAHHMMH  ++ ( A,A      D   IIIIII55MRRR599Y//5266<<>> uyy,,23399;;BB3GG  ''$=(=        - ..4"55;;==G=00I4IJJPPRRYYZ]^^H  s%BB B-,B-1BE EE)rr)N)r!r)rr)r/rrr0) __doc__ __future__rrrtypingrr r#r-r@rrFs66"""""" ####L)))))$))));@55555555rE