yj JdZddlmZddlmZddZdd ZddZddZddZ dS)zFHelpers for reading the effective fallback provider chain from config.) annotations)Anyvaluerreturnstrc~t|tsdS|dS)N/) isinstancerstriprstrip)rs @/home/ragecks/.hermes/hermes-agent/hermes_cli/fallback_config.py_normalized_base_urlrs5 eS ! !r ;;==   $ $$entrydict[str, Any] | None str | Nonect|tsdSt|dpd}|r|St|dp|dpd}|r'ddlm}||pdpdSdS)u^API key for one fallback entry: inline ``api_key``, else ``key_env``. Mirrors the custom-provider convention (``key_env`` names the env var holding the key; ``api_key_env`` accepted as an alias). Returns None when neither yields a non-empty value, letting ``resolve_runtime_provider`` fall through to the provider's standard credential resolution. ``key_env`` is resolved through ``agent.secret_scope.get_secret`` rather than a raw ``os.getenv`` — in a multiplexed gateway a bare env read would ignore the active profile's scope and can return another profile's credential. ``get_secret`` already implements the right fallback: it reads ``os.environ`` when there's no active multiplexed scope (matching prior single-profile behavior), and fails closed only when multiplexing is active with no scope installed. Napi_keyr key_env api_key_envr) get_secret)r dictrgetr agent.secret_scoper)rinlinerrs rresolve_entry_api_keyrs eT " "t 9%%+ , , 2 2 4 4F  %))I&&H%))M*B*BHbIIOOQQG;111111 7##)r0022:d: 4rrawlist[dict[str, Any]]c6t|tr|g}nt|tr|}ngSg}|D]}t|tst|dpd}t|dpd}|r|st|}||d<||d<t |d}|r||d<|||SNproviderr modelbase_url)r rlistrrr rappend)r candidatesentriesrr"r# normalizedr$s r_iter_fallback_entriesr*+s.#tU C    $&G##%&&  uyy,,23399;;EIIg&&,"--3355 u  %[[ !) :# 7' *(=(=>>  .%-Jz "z"""" Nrdict[str, Any]tuple[str, str, str]ct|dpdt|dpdt |dfSr!)rrr lowerr)rs r_entry_identityr/Hs EIIj ! ! 'R((..006688 EIIg   $"%%++--3355UYYz223399;; rconfigc|pi}g}t}dD]e}t||D]@}t|}||vr||||Af|S)anReturn the effective fallback chain merged across old and new config keys. ``fallback_providers`` remains the primary source of truth and keeps its order. Legacy ``fallback_model`` entries are appended afterwards unless they target the same provider/model/base_url route as an earlier entry. The returned list always contains fresh dict copies. )fallback_providersfallback_model)setr*rr/addr&)r0chainseenkeyridentitys rget_fallback_chainr:Ps\rF"$E&)eeD7  +FJJsOO<<  E&u--H4 HHX    LL       LrN)rrrr)rrrr)rrrr)rr+rr,)r0rrr) __doc__ __future__rtypingrrrr*r/r:rrr?sLL""""""%%%% ::r