eiU$ dZddlZddlZddlZddlZddlZddlmZddlm Z m Z ddl m Z ddl Z ejeZehdZd,de d ed efd Zd-d ed ed efdZded dfdZdeddd dfdZddde eefde dede d df dZddddde eefde dedededzd df dZd.ded e d e fd Zd/d!ed ed efd"Zd,d!ed ed efd#Zd$Zd%edzd edzfd&Z d0d'Z!d(ed efd)Z"d(ed*ed efd+Z#dS)1z*Shared utility functions for hermes-agent.N)Path)AnyUnion)urlparse>1onyestrueFvaluedefaultreturnc||St|tr|St|tr-|t vSt|S)zDCoerce bool-ish values using the project's shared truthy string set.) isinstanceboolstrstriplowerTRUTHY_STRINGS)r r s '/home/div/.hermes/hermes-agent/utils.pyis_truthy_valuers` }% %7{{}}""$$66 ;;namecJttj||dS)zBReturn True when an environment variable is set to a truthy value.Fr rosgetenv)rr s renv_var_enabledrs! 29T733U C C CCrpathz int | Nonec |r+tj|jndS#t$rYdSwxYw)zBCapture the permission bits of *path* if it exists, else ``None``.N)existsstatS_IMODEst_modeOSError)r s r_preserve_file_moder'$sV48KKMMKt|DIIKK/000tK ttsAA AAmodec\|dS tj||dS#t$rYdSwxYw)aRe-apply *mode* to *path* after an atomic replace. ``tempfile.mkstemp`` creates files with 0o600 (owner-only). After ``os.replace`` swaps the temp file into place the target inherits those restrictive permissions, breaking Docker / NAS volume mounts that rely on broader permissions set by the user. Calling this right after ``os.replace`` restores the original permissions. N)rchmodr&)r r(s r_restore_file_moder+,sM |  t      s  ++)indentdatar- dump_kwargsc t|}|jddt|}t jt |jd|jdd\}} tj |dd 5}tj ||f|d d || tj |d d d n #1swxYwYtj||t!||d S#t"$r( tj|n#t&$rYnwxYwwxYw) aWrite JSON data to a file atomically. Uses temp file + fsync + os.replace to ensure the target file is never left in a partially-written state. If the process crashes mid-write, the previous version of the file remains intact. Args: path: Target file path (will be created or overwritten). data: JSON-serializable data to write. indent: JSON indentation (default 2). **dump_kwargs: Additional keyword args forwarded to json.dump(), such as default=str for non-native types. Tparentsexist_ok._.tmpdirprefixsuffixwutf-8encodingF)r- ensure_asciiN)rparentmkdirr'tempfilemkstemprstemrfdopenjsondumpflushfsyncfilenoreplacer+ BaseExceptionunlinkr&)r r.r-r/ original_modefdtmp_pathfs ratomic_json_writerR=s( ::DKdT222'--M#   49LB  Yr3 1 1 1 !Q I "         GGIII HQXXZZ  ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! 8T"""4/////   Ih        D  sU1DAC% D%C))D,C)-(D E "D76E 7 EE EE )default_flow_style sort_keys extra_contentrSrTrUct|}|jddt|}t jt |jd|jdd\}} tj |dd 5}tj |||| |r| || tj|d d d n #1swxYwYtj||t#||d S#t$$r( tj|n#t($rYnwxYwwxYw) anWrite YAML data to a file atomically. Uses temp file + fsync + os.replace to ensure the target file is never left in a partially-written state. If the process crashes mid-write, the previous version of the file remains intact. Args: path: Target file path (will be created or overwritten). data: YAML-serializable data to write. default_flow_style: YAML flow style (default False). sort_keys: Whether to sort dict keys (default False). extra_content: Optional string to append after the YAML dump (e.g. commented-out sections for user reference). Tr1r4r5r6r7r;r<r=)rSrTN)rr@rAr'rBrCrrDrrEyamlrGwriterHrIrJrKr+rLrMr&) r r.rSrTrUrNrOrPrQs ratomic_yaml_writerYrs, ::DKdT222'--M#   49LB  Yr3 1 1 1 !Q IdA2DPY Z Z Z Z ' &&& GGIII HQXXZZ  ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! 8T"""4/////   Ih        D  sU1D0A*C>2 D0>DD0D(D00 E";EE" EE"EE"textct tj|S#tjttf$r|cYSwxYw)zParse JSON, returning *default* on any parse error. Replaces the ``try: json.loads(x) except (JSONDecodeError, TypeError)`` pattern duplicated across display.py, anthropic_adapter.py, auxiliary_client.py, and others. )rFloadsJSONDecodeError TypeError ValueError)rZr s rsafe_json_loadsr`sEz$  )Z 8s 77keyctj|d}|s|S t|S#tt f$r|cYSwxYw)z:Read an environment variable as an integer, with fallback.r)rrrintr_r^)rar raws renv_intrese )C   " " $ $C 3xx  "s<AAcJttj|d|S)z*Read an environment variable as a boolean.rrr)rar s renv_boolrgs! 29S"--w ? ? ??r) HTTPS_PROXY HTTP_PROXY ALL_PROXY https_proxy http_proxy all_proxy proxy_urlct|pd}|sdS|drd|t ddS|S)zNormalize proxy URLs for httpx/aiohttp compatibility. WSL/Clash-style environments often export SOCKS proxies as ``socks://127.0.0.1:PORT``. httpx rejects that alias and expects the explicit ``socks5://`` scheme instead. rNzsocks://z socks5://)rrr startswithlen)rn candidates rnormalize_proxy_urlrsssIO$$**,,I t##J//989S__%5%56888 rctD]=}tj|d}t|}|r||kr|tj|<>dS)zARewrite supported proxy env vars to canonical URL forms in-place.rN)_PROXY_ENV_KEYSrrrsenviron)rar normalizeds rnormalize_proxy_env_varsrxsW)) #r""(//  )*--(BJsO ))rbase_urlc|pd}|sdStd|vr|nd|}|jpddS)aReturn the lowercased hostname for a base URL, or ``""`` if absent. Use exact-hostname comparisons against known provider hosts (``api.openai.com``, ``api.x.ai``, ``api.anthropic.com``) instead of substring matches on the raw URL. Substring checks treat attacker- or proxy-controlled paths/hosts like ``https://api.openai.com.example/v1`` or ``https://proxy.test/api.openai.com/v1`` as native endpoints, which leads to wrong api_mode / auth routing. rz://z//r4)rrhostnamerrstrip)ryrdparseds rbase_url_hostnamer~sl >r " "C r Uc\\cczCzz : :F O !r ( ( * * 1 1# 6 66rdomainct|}|sdS|pdd}|sdS||kp|d|zS)acReturn True when the base URL's hostname is ``domain`` or a subdomain. Safer counterpart to ``domain in base_url``, which is the substring false-positive class documented on ``base_url_hostname``. Accepts bare hosts, full URLs, and URLs with paths. base_url_host_matches("https://api.moonshot.ai/v1", "moonshot.ai") == True base_url_host_matches("https://moonshot.ai", "moonshot.ai") == True base_url_host_matches("https://evil.com/moonshot.ai/v1", "moonshot.ai") == False base_url_host_matches("https://moonshot.ai.evil/v1", "moonshot.ai") == False Frr4)r~rrr|endswith)ryrr{s rbase_url_host_matchesrs|!**H ul ! ! # # ) ) + + 2 23 7 7F u v  @!2!23rsU00  !!!!!!  8 $ $555663$DD#DDTDDDD d| T  $    * 222 T 2 2  2  2  2222r % $ 000 T 0 0 0  0 : 0 0000l  #  s     s3@@#@@@@@@ 3: #*    ))))777777"ACAAAAAAAAr