yjdZddlmZddlZddlZddlmZmZddlZej e Z dZ dZ e e dddZddZe e dddZdS)utBounded reads of HTTP error response bodies. When a provider returns a non-OK status on a *streaming* request, Hermes reads the response body to build a useful diagnostic error. A bare ``response.read()`` on a streaming httpx response is unbounded in two dangerous ways: 1. A server can declare (or stream) an arbitrarily large body, so the read can balloon memory. 2. A server can open the body and then stall forever (no ``Content-Length``, no further bytes), so the read hangs the agent indefinitely. Both are realistic against a misbehaving proxy, a hijacked endpoint, or a provider having a bad day. The diagnostic body is only ever shown to the user truncated to a few hundred characters, so reading megabytes — or blocking forever — buys nothing. ``read_streaming_error_body`` bounds the read to a byte cap and enforces a hard wall-clock deadline, returning the decoded text snippet. Callers pass the returned text into their existing error builders instead of touching ``response.text`` (which would be unbounded / would raise after a partial stream read). A subtlety the implementation must respect: ``httpx``'s ``iter_bytes()`` blocks *inside* the C/socket read while waiting for the next chunk. A wall-clock check placed only between yielded chunks cannot interrupt a server that opens the body and then stalls mid-chunk — control never returns to Python until httpx's own (often 30s+) read timeout fires. To guarantee a bounded stop regardless of socket behavior, the read runs on a daemon worker thread and the caller waits on it with a hard deadline; on timeout we close the response (which unblocks / cancels the read) and return whatever partial bytes were collected. Ported and adapted from openclaw/openclaw#95108 ("bound Anthropic error streams"), generalized to cover Hermes's three streaming error-body sites (native Gemini, Gemini Cloud Code, Antigravity Cloud Code). ) annotationsN)ListOptionalig$@ max_bytes timeout_sresponsehttpx.ResponserintrfloatreturnstrcFgdditjdfd }tj|dd}|| }|sCt d |td Dtntdr3t d td Dd  ddS)aRead a non-OK streaming response body with a byte cap and a hard deadline. Returns the decoded body text (UTF-8, errors replaced), truncated to ``max_bytes``. Never raises: any transport error, stall, or oversize condition is swallowed and the best-effort partial text (or an empty string) is returned, because this runs on the error path and must not mask the original HTTP failure with a read error. The byte cap protects against huge bodies; the wall-clock deadline (enforced via a worker thread so it can interrupt a socket read that stalls mid-chunk) protects against bodies that open and then hang. truncatedFr Nonecd} D]z}|s|z }|dkrdd<ndt||kr)|d|||z }dd<n(||t|z }{n2#t$r%}td|Yd}~nd}~wwxYwdS#wxYw)NrTrz"bounded error-body read failed: %s) iter_byteslenappend Exceptionloggerdebugset) totalchunk remainingexcchunksdonerr states ._drainNs+ !,,.. $ $%- >>)-E+&Eu:: ))MM%  "3444Y&E)-E+&E e$$$U# D D D LL=s C C C C C C C C D HHJJJJJDHHJJJJs0BBC CB?:C?CCC3zbounded-error-body-readT)targetnamedaemon)timeoutzCbounded error-body read: hard timeout after %.1fs (%d bytes so far)c34K|]}t|VdSNr.0cs r! z,read_streaming_error_body..n(''1A''''''z4bounded error-body read: capped at %d bytes (max=%d)c34K|]}t|VdSr(r)r*s r!r-z,read_streaming_error_body..zr.r/r/zutf-8replace)errors)r r) threadingEventThreadstartwaitrrsum _safe_closejoindecode) r rrr"workerfinishedrrr s `` @@@r!read_streaming_error_bodyr>8sc$F % E ?  D, 5dF LLNNNyyy++H   Q  ''''' ' '    HH [  B ''''' ' '    88F   " "79 " = ==r/rcR |dS#t$rYdSwxYwr()closer)r s r!r9r9s?       s  && Optional[str]c.t|||}|pdS)zLike ``read_streaming_error_body`` but returns ``None`` on empty body. Convenience for callers that distinguish "no body" from "empty string". rN)r>)r rrtexts r!read_error_body_or_defaultrDs+ %I   D <4r/)r r rr rr r r)r r r r)r r rr rr r rA)__doc__ __future__rloggingr3typingrrhttpx getLogger__name__rDEFAULT_ERROR_BODY_MAX_BYTESDEFAULT_ERROR_BODY_TIMEOUT_Sr>r9rDr/r!rOs""H#"""""!!!!!!!!  8 $ $ ) $ 23 E>E>E>E>E>E>P    23        r/