nSjd$ &UdZddlZddlZddlZddlmZmZddlmZ m Z  ddl m Z e ddn #e$rYnwxYw ddlZddlZdd lmZn #e$rdZYnwxYwejeZd ZiZeed <d efd Zddeed efdZd eefdZdeed eefdZ ddZ!ddeed eeeeeffdZ"efdeded efdZ# ddeedeed eeeeeffdZ$d e%fdZ&dS)uVertex AI (Google Cloud) adapter for Hermes Agent. Provides authentication and configuration for Vertex AI's OpenAI-compatible endpoint. This allows Hermes to use Gemini models via Google Cloud with enterprise-grade rate limits and quotas. Requires: pip install google-auth Environment variables honored (all optional): GOOGLE_APPLICATION_CREDENTIALS — path to a service account JSON file (secret). VERTEX_CREDENTIALS_PATH — alias, takes precedence if set (secret). VERTEX_PROJECT_ID — override the project_id embedded in creds. VERTEX_REGION — override default region ("global" unless set). Non-secret routing settings (project_id, region) also live in config.yaml under the ``vertex:`` section; env vars take precedence over config.yaml. N)OptionalTuple) get_secretis_multiplex_active)ensurezprovider.vertexF)prompt)service_accountglobal _creds_cachereturnc ddlm}|d}t|tr|niS#t $ricYSwxYw)u0Return the ``vertex:`` section of config.yaml, or {} on any failure. Non-secret routing settings (project_id, region) live in config.yaml per the .env-secrets-only rule. Env vars still take precedence — they are read directly at the call sites below, with config.yaml as the fallback. r) load_configvertex)hermes_cli.configrget isinstancedict Exception)rsections 6/home/ice/.hermes/hermes-agent/agent/vertex_adapter.py_vertex_configr2so111111+--##H--$Wd33;ww;  s;> A  A explicitc|r|Stdpd}|r|Sttdpd}|pt S)zLRegion precedence: explicit arg > VERTEX_REGION env > config.yaml > default. VERTEX_REGIONregion) _get_secretstripstrrrDEFAULT_REGION)r env_region cfg_regions r_resolve_regionr#Bsxo..4";;==J^%%))(339r::@@BBJ  ''ctdpd}|r|Sttdpd}|pdS)zProject-ID override precedence: VERTEX_PROJECT_ID env > config.yaml. Returns None when neither is set (the credentials' embedded project_id is used in that case). VERTEX_PROJECT_IDr project_idN)rrrrr) env_project cfg_projects r_resolve_project_overrider*Msn 2339r@@BBKn&&**<88>B??EEGGK  $r$c|r!tj|r|SdD]6}t|}|r#tj|r|cS7dS)N)VERTEX_CREDENTIALS_PATHGOOGLE_APPLICATION_CREDENTIALS)ospathexistsr)renv_varr/s r_resolve_credentials_pathr2ZsoBGNN8,,Q7##  BGNN4(( KKK 4r$ctjjj}||dSN)googleauth transportrequestsRequestrefresh)credsauth_reqs r_refresh_credentialsr=js3{$-5577H MM(r$credentials_pathcPttddSt|}|pd} t|}||r*t j|dg}|j }nmtr;tj drtddStj dg\}}||ft|<n|\}}t|d d pTt|d d pCt|d dduo0|jt%jz d k}|rt'|t)}|r|}|j|fS#t,$r}td|t|d|dkr@t|} | r/td| t5| cYd}~SYd}~dSd}~wwxYw)zReturn a (fresh access_token, project_id) pair or (None, None) on failure. Caches the underlying Credentials object and refreshes it when within 5 minutes of expiry, so repeated calls don't thrash the token endpoint. Nz8google-auth package not installed. Cannot use Vertex AI.NN__adc__z.https://www.googleapis.com/auth/cloud-platform)scopesr-zVertex ADC skipped for this profile: GOOGLE_APPLICATION_CREDENTIALS is set in the process environment (from another profile's .env) but not in this profile's own config. Set VERTEX_CREDENTIALS_PATH in this profile's .env instead of relying on ADC.tokenexpiredFexpiryi,z)Failed to resolve Vertex AI credentials: z-ADC failed, retrying with service account: %s)r5loggerwarningr2r rr Credentialsfrom_service_account_filer'rr.environr6defaultgetattrrE timestamptimer=r*rCrerrorpopinfoget_vertex_credentials) r> resolved_path cache_keycachedr;r' needs_refreshoverride_projectesa_paths rrRrRos~ ~QRRRz-.>??M*I?!!),, > '3MM!LMN#- '((&RZ^^<\-]-]&NNL&:$*K$7$7LM%8%%!z(-j&9L # # & E:w-- - ui// x..d:C\++-- ;sB   (  ' ' '466  *)J{J&&     DDDEEED)))  ! !/0@AAG 7 KWUUU-g66666666zzzzz s&BF CF H%A8H H% H%r'rc4|dkrdn|d}d|d|d|dS)a.Build the OpenAI-compatible base URL for Vertex AI. The `global` location uses a bare `aiplatform.googleapis.com` hostname, while regional locations use `{region}-aiplatform.googleapis.com`. Gemini 3.x preview models are only served via the global endpoint at the time of writing. r zaiplatform.googleapis.comz-aiplatform.googleapis.comzhttps://z/v1beta1/projects/z /locations/z/endpoints/openapi)r'rhosts rbuild_vertex_base_urlr]sC+1H*<*< & &VBgBgBgD _d _ _j _ _V _ _ __r$cxt|\}}|r|sdSt|}t||}||fS)zKResolve (access_token, base_url) for Vertex AI, or (None, None) on failure.r@)rRr#r])r>rrCr'effective_regionbase_urls rget_vertex_configrasS //?@@E:  z&v..$Z1ABBH (?r$cHtdrdStrdSdS)uPFast check for whether Vertex credentials appear configured. No network calls and no google-auth import — safe for provider auto-detection and setup-status display. True when either a service account JSON path is resolvable, or an explicit project ID is configured (env or config.yaml, implying ADC is intended). NTF)r2r*r[r$rhas_vertex_credentialsrcs1!&&t ""t 5r$r4)r Nr@)'__doc__loggingr.rNtypingrragent.secret_scoperrrtools.lazy_depsr _lazy_ensurer google.authr5google.auth.transport.requests google.oauth2r ImportError getLogger__name__rFr r r__annotations__rrr#r*r2r=rRr]raboolrcr[r$rrrs$ """"""""MMMMMMMM  666666L"511111   D ))))------- FFF  8 $ $ d      ((hsm(s(((( 8C=      (3-      LLXc]LeHUXM[cdg[hLhFiLLLL^:H ` `c `3 `C ` ` ` `'+   sm  SM  8C=(3- '(           s5==AAA