߲jh UdZddlmZddlZddlmZddlmZddlm Z d9dZ d:dZ d:d Z d;d Z d;d Zdd?dZd@dZdAdZdddBdZdCdZdDdZdEdZdCdZdZdFdZdAdZdddBdZdAdZhdZded <d!Z d"d#d$d%d&ejBjEd'd(ejBjEd)d*fZ#d+Z$dFd,Z%dGd-Z&dHd.Z'd/Z(dId0Z)dJd1Z*dKd2Z+dFd3Z,dLdMd4Z-dLdNd5Z.d6Z/dJd7Z0dFd8Z1y)OaShared file safety rules used by both tools and ACP shims. Every guard here is defense-in-depth, NOT a security boundary: the terminal tool runs as the same OS user and can read/write anything. The value is a clear denial for models that respect tool errors plus a visible audit trail. ) annotationsN)Path)suppress)Optionalc ddl}t||S#t$r+ttj j dcYSwxYw)zeCall ``hermes_constants.()`` (local import avoids cycles); ``~/.hermes`` on any failure.rNz ~/.hermes)hermes_constantsgetattr Exceptionrospath expanduser) getter_namers 6/home/ubuntu/.hermes/hermes-agent/agent/file_safety.py_constants_pathrsF55w'577 5BGG&&{3445s1A  A ctdS)z@Active HERMES_HOME (profile-aware). Tests monkeypatch this name.get_hermes_homerr_hermes_home_pathrs , --rctdS)z;Hermes root dir (parent of any profile, never per-profile).get_default_hermes_rootrrrr_hermes_root_pathrs 4 55rc tttjtt t fS)zResolved active HERMES_HOME and global root, deduplicated. Both are checked so credential stores at /... stay guarded when running under a profile (HERMES_HOME = /profiles/). )listdictfromkeys _resolve_eachrrrrr _hermes_dirsr$s*  m->-@BSBU,VWX YYrcg}|D]9}tt5|j|jddd;|S#1swYGxYw)zB``p.resolve()`` for each path, skipping ones that fail to resolve.N)rr appendresolve)pathsoutps rrr-sQC $ i  $ JJqyy{ # $ $$ J $ $s AA ct|tr |j|duS||k(xs+|j t |t jzS#t$rYywxYw)zTrue when ``resolved`` equals ``base`` or lies below it (both already resolved); ``Path`` inputs use ``relative_to`` (platform semantics), ``str`` a realpath prefix test.NF) isinstancer relative_to ValueError startswithstrr sep)resolvedbases r _is_underr/6sg(D! ''-T9 9 t  Fx223t9rvv3EFF  sA A#"A#cttt5ttj j t|jcdddS#1swYyxYw)zD``Path(expanduser(path)).resolve()``, or None when resolution fails.N) rOSError RuntimeErrorrr r r r+r"r s r_resolve_targetr4AsH '< (=BGG&&s4y12::<=== s ?AA'set[str]ctjjdh}tt5ddlm}m}m}|||fD]}|s|jt|! dddt|}t|dkDr|jdrv|ddvro|ddjdddjddd}tjjd|}|jds|j||D chc]!} tjj| #c} S#1swYxYwcc} w) uEvery home the write guards must cover. Process ``~`` alone is wrong whenever the process HOME is not the OS user's real home — ``TERMINAL_HOME_MODE=profile``, containers, and spawned workers pin ``HOME`` to ``{HERMES_HOME}/home``, which leaves the real home's credential paths unguarded against absolute-path writes while file tools happily write there (and ``_expand_tilde`` may route ``~`` to yet another home). Deny/approval lists are built over the union: process home, real home, subprocess home, and the profile home. A ``~name/...`` input resolves to a named account's home, which joins the set so ``~root/.ssh/authorized_keys`` stays denied.~r) get_real_homeget_subprocess_home_profile_home_pathNz/\/\)r r r rr rr8r9r:addr+lenr*splitrealpath) r homesr8r9r: candidaterawnameexpandedhs r _guard_homesrHHs"WW   $ %E ) *[['/+>+@BTBVW *I #i.) ** d)C 3x!|s+Ae0C12w}}S!$Q'--dA6q977%%$j1""3' IIh ). /ABGG  Q  //** 0s$EE&EEct|tjjtjj t |fS)uR``(guard homes, realpath(expanduser(path)))`` — the write-guard coordinate pair.)rHr r rAr r+r3s r_homes_and_resolvedrJas4  rww//0B0B3t90MN NNrct|jdd}|jdry|jdry|jdr8|dd}|j}|jd s|jd ryy ) uReturn True if ``path`` is a Windows NT-/device-namespace path. Checks the raw string only — never resolves the path (resolving is the credential-leak trigger this guard exists to prevent). r<r=z\??\Tz\\.\z\\?\NzUNC\z GLOBALROOT\F)r+replacer*upper)r srestrNs ris_nt_namespace_pathrQs{ D #t$A||H||I||Iu    G $(8(8(H rAccessverbc*t|sy|d|dS)zCReturn an error message when ``path`` uses the NT/device namespace.N denied: 'a' uses a Windows NT/device namespace prefix (\??\, \\.\, \\?\UNC\, or GLOBALROOT). These paths bypass normal path normalization and can trigger outbound SMB authentication (NTLM credential leak) merely by being resolved. Use a normal absolute path instead.)rQ)r rTs rget_nt_namespace_errorrWs'  % & 4&!. .rcfd}ddtjjddtjjddtjjddf}gfd |Dd |Dd d d }|Dchc]!}tjj|#c}Scc}w)z8Return exact sensitive paths that must never be written.)).sshauthorized_keys)rYid_rsa)rY id_ed25519)z.netrc)z.pgpass)z.npmrc)z.pypirc)z.git-credentials.env.anthropic_oauth.jsonauthgoogle_oauth.jsoncachebws_cache.jsonzbws_cache.enc.jsonc3^K|]$}tjjg|&ywNr r join).0fhomes r z+build_write_denied_paths..s# 5Q"'',,t a 5*-c3jK|]+}ttfD]}t||z -ywrd)rrr+)rgrhr.s rrjz+build_write_denied_paths..s1 eA;L;NPaPc:d e$#dQh- e- es13z /etc/sudoersz /etc/passwdz /etc/shadow)r r rfrA)ri home_files hermes_filesr#r%s` rbuild_write_denied_pathsros J '  V01  W./  W23 L   5* 5  e e   & (5 E */ /ABGG  Q  // /s&B.cgfddDddfddD}|Dcgc]2}tjj|tjz4c}Scc}w)z?Return sensitive directory prefixes that must never be written.c3^K|]$}tjj|&ywrdrergdris rrjz.build_write_denied_prefixes..s MA"'',,tQ  Mrk)rYz.awsz.gnupgz.kubez/etc/sudoers.dz /etc/systemdc3^K|]$}tjjg|&ywrdrerrs rrjz.build_write_denied_prefixes..s# pQ"'',,t a prk))z.docker)z.azure).configgh)rugcloud)r r rAr,)rir#r%s` rbuild_write_denied_prefixesrxsg  M)L M  (  q*o p E 38 8QBGG  Q "&& ( 88 8s7Ac t}tdtjddj tj D]j}t tt5|jtjjtjj|dddl|S#1swYxxYw)zFResolved HERMES_WRITE_SAFE_ROOT paths (``os.pathsep``-separated list).NHERMES_WRITE_SAFE_ROOT) setfilterr getenvr@pathseprr1r)r>r rAr )rootsr s rget_safe_write_rootsrseEtRYY'?DJJ2::VWB gz * B IIbgg&&rww'9'9$'?@ A B BB L B Bs A B77C ctjjtjj|ddhS)ayPaths that need human APPROVAL to write but are not hard-denied credentials. ``~/.ssh/config`` is routine to edit and holds no key bytes, but can carry ``ProxyCommand`` / ``Match exec``. Interactive file tools prompt (approve-once/session/always, like the terminal tool's ``~/.ssh`` gate); non-interactive callers (ACP shims, background jobs) fail closed. rYconfig)r r rArf)ris rbuild_write_approval_pathsrs- GG  RWW\\$A B CCr)zstate.dbsessions mcp-tokenspairingvaultbrowser-profilec t|ryt|\}tfd|Drytfd|DrytD]}tD]w}t t 5ttjjtjjt||r dddy dddyt}|rtfd|Dsyy#1swYxYw)z`Return ``'credential'``, ``'safe_root'``, ``'nt_namespace'``, or ``None`` if writes are allowed. nt_namespacec38K|]}t|vywrdrrgrir-s rrjz)_classify_write_denial..s JD81$7 7 JNc3vK|]0}t|vxstfdt|D2yw)c3@K|]}j|ywrd)r*)rgprefixr-s rrjz3_classify_write_denial... s[vx""6*[sN)roanyrxrs rrjz)_classify_write_denial..sG   ,T22 \ [9TUY9Z[ [ \ s69 credentialc36K|]}t|ywrdr/)rgrootr-s rrjz)_classify_write_denial..sODi$7Os safe_root)rQrJrr_HERMES_PROTECTED_SUBPATHSrr r/r r rArfr+r)r rBr.sub safe_rootsr-s @r_classify_write_denialrs D!)$/OE8 JE JJ    (- (C)$ (Xrww'7'7 SYPS8T'UV' ( (V ( ( (( &'J#OJOO  ( (s +AC77D ct|duS)zBReturn True if path is blocked by the write denylist or safe root.N)rr3s ris_write_deniedrs !$ 't 33rWritect|}|dk(r;tjjt t }|d|d|dS|dk(r t ||S|r|d|dSdS) zEReturn a user/model-facing error when writes to ``path`` are blocked.rrVz%' is outside HERMES_WRITE_SAFE_ROOT (z:). Unset the variable or add this path's directory prefix.rrSz(' is a protected system/credential file.N)rr rrfsortedrrW)r rTdenial roots_displays rget_write_denied_errorr s #D )F  /C/E(FG fJtf%X Z %d66PVdV:dV#K L`\``rcHt|\}tfd|DS)zTrue if ``path`` is approval-gated (``~/.ssh/config``): interactive callers prompt, callers without a channel treat it as a block (fail closed).c38K|]}t|vywrdrrs rrjz-is_write_approval_required..2sNx5d;;Nr)rJr)r rBr-s @ris_write_approval_requiredr.s$*$/OE8 NN NNr>.envrc .env.test .env.local .env.staging.env.production.env.developmentr]_BLOCKED_PROJECT_ENV_BASENAMESuT (Defense-in-depth — not a security boundary; the terminal tool can still bypass.)z auth.jsonz auth.lockr^r]zwebhook_subscriptions.jsonr_r`rarb))rz>is the Hermes MCP token directory and cannot be read directly.z7is a Hermes MCP token file and cannot be read directly.)rzjis the Hermes real-profile browser snapshot directory (copied cookies/logins) and cannot be read directly.zgis inside the Hermes real-profile browser snapshot (copied cookies/logins) and cannot be read directly.)rz|is the Hermes credential vault directory and cannot be read directly (secrets are filled server-side by browser_vault_fill).zis inside the Hermes credential vault (encrypted secrets + local key) and cannot be read directly (browser_vault_fill resolves them server-side).ct|d}|r|St|jjt d}t fdDrd}nt fdt Dr dtz}nutD]A\}}tfdDD] }t|s|k(r|n|tz}n|sAn|)jjtvr d tz}|rd |d |SdS) ajReturn an error message when a read targets a denied Hermes path. Blocked: internal skill-hub caches (prompt-injection carriers), credential stores under HERMES_HOME and the global root (exact files, plus anything under ``mcp-tokens/`` and ``browser-profile/``), and project-local ``.env`` files anywhere on disk (``.env.example`` is the documented-shape substitute). Callers that resolve relative paths against a non-process cwd (e.g. ``TERMINAL_CWD``) MUST pass an absolute path: ``resolve()`` here anchors at the process cwd, so a relative ``"auth.json"`` would miss the denylist. ReadrSNc3BK|]}t|dz dz yw)skillsz.hubNr)rghdr-s rrjz'get_read_block_error..ns! M29XrH}v5 6 Mszis an internal Hermes cache file and cannot be read directly to prevent prompt injection. Use the skills_list or skill_view tools instead.c3LK|]tfdDvyw)c3(K|] }|z  ywrdr)rgrrEs rrjz1get_read_block_error...ss&GRrDy&GN)r)rgrE hermes_dirsr-s @rrjz'get_read_block_error..ss! kDX&G;&GG G ks $z}is a Hermes credential store and cannot be read directly. Provider tools consume these credentials through internal channels.c3(K|] }|z  ywrdr)rgrsubdirs rrjz'get_read_block_error..zs,ORR&[,Orzis a secret-bearing environment file and cannot be read to prevent credential leakage. If you need to check the file structure, read .env.example instead.zAccess denied:  )rWrr r"rr_CREDENTIAL_FILE_NAMES _DID_SUFFIX_READ_DENIED_DIRSrr/rElowerr) r nt_errorreasondir_msgfile_msg blocked_dirrr-rs @@@rget_read_block_errorrWs%"&d8HDz$$&..0H.K F M MM Q  kTj k k CEP Q  *;  %FGX,,O;,OO  X{3)1[)@ghR]]F    >hmm1137UU_alm 17_TF!F8 ,@D@rcT t|}|r t|y#t$rYywxYw)a.Raise ``ValueError`` if ``path`` is a denied Hermes read (see ``get_read_block_error``). Shared chokepoint for provider input-loading sites (e.g. image-gen local paths). Best-effort: unexpected internal errors no-op rather than break local-file loading; a real block still propagates. N)rr r))r blockeds rraise_if_read_blockedrs:&t,!! s  ''c tjjtjdz j}|r|dSdS#t t tf$rYywxYw)zActive profile name from HERMES_HOME: ``~/.hermes`` -> ``"default"``, ``~/.hermes/profiles/X`` -> ``"X"``; ``"default"`` on any resolution failure.profilesdefaultr)rr"r(rpartsr1r2r))rs r_resolve_active_profile_namersj!#++-99:K:M:U:U:WZd:dekk58+)+ \: .sA AA,+A,u[Sandbox-mirror write blocked by soft guard: {target_path} sits under {mirror_root!r}, which is {body} Use the host-side tool for authoritative state (e.g. ``memory`` for memories), or address the host path directly. To bypass {bypass} with ``cross_profile=True``. (Defense-in-depth — not a security boundary; the terminal tool can still bypass.)c2t|t||dS)z1Common ``classify_*_mirror_target`` result shape.) target_path mirror_root inner_path)r+)targetrrs r _mirror_inforsv;s;7GWa bbrc t|}| |jndtfdtDd}|y|dzt krt t |dzdnd}t|t d|dz|S)uClassify a write target as a sandbox-mirror of authoritative Hermes state: ``None`` for non-mirror paths, else ``target_path`` (resolved), ``mirror_root`` (the ``…/home/.hermes`` prefix) and ``inner_path`` (what the agent meant on the host).Nrc3K|]8\}}|dk(r.|dztkr|dzdk(r|dzdk(r|dz:yw) sandboxesrirLz.hermesN)r?)rgipartrs rrjz1classify_sandbox_mirror_target..s] q71d K AECJ$65Q<6;QV[\]`a\aVbfoVo Q qs>Ar;r{)r4rnext enumerater?r+rr)r r inner_idxinnerrs @rclassify_sandbox_mirror_targetrsT "F".FLLBE qi. q I 1:QU1KCeIMN+, -QSE eOi!m&< =u EErcb|ytjdi||j|d|dS)z_Render ``_SANDBOX_MIRROR_WARNING`` for a classify_* result (``body`` may use ``{inner_path}``).Nr)r)bodybypassr)_SANDBOX_MIRROR_WARNINGformat)inforrs r_mirror_warningrs7 | " ) ) qD qt{{dS_N`{7ajp qqrc.tt|ddS)zModel-facing soft-guard warning when ``path`` lands in a sandbox mirror, else ``None``; the caller surfaces it as a tool-result error and ``cross_profile=True`` bypasses.ua per-task mirror created by a non-local terminal backend (docker/daytona/etc.). Writes here land on a copy that the host Hermes process never reads — the authoritative file is likely {inner_path!r} under the real HERMES_HOME.z8this guard after explicit user direction, retry the call)rrr3s rget_sandbox_mirror_warningrs% &t, R C  rct||r t|nd}}|| t||syt|||j|j S)usClassify a write target as a container-side sandbox mirror. Inside the container the bind mount strips the ``sandboxes/`` prefix (the agent sees plain ``/root/.hermes/…``), so the caller supplies ``mirror_prefix`` once it knows file tools run in a docker sandbox. ``None`` without a prefix or outside it, else ``target_path``/``mirror_root``/``inner_path``.N)r4r/rr(as_posix)r mirror_prefixrmirrors r classify_container_mirror_targetrsT %T*mOM,JaeFF ~y/H (:(:6(B(K(K(M NNrc0tt||ddS)z]Model-facing soft-guard warning when ``path`` lands in the container's mirror, else ``None``.uthe container's bind-mounted home — a per-task mirror that the host Hermes process never reads. The authoritative file is {inner_path!r} under the real HERMES_HOME.z$after explicit user direction, retry)rr)r rs rget_container_mirror_warningrs# (}=  /  r)rpluginscronmemoriesc ttjjt |j }t j }d}d} |j|}|j}|sy|dtvrd}|d}n-|ddk(r$t|dk\r|dtvr |d}|d}nyt}||k(ry|||t |dS#ttf$rYywxYw#t$rYywxYw) uClassify a write target as cross-profile if it lands in another profile's scoped area (skills/plugins/cron/memories). Returns ``None`` when the target is outside Hermes scope, or is inside the ACTIVE profile, or doesn't hit a profile-scoped area. Otherwise returns a dict with: * ``active_profile``: name of the profile the agent is running as * ``target_profile``: name of the profile the path belongs to * ``area``: which scoped area (``"skills"``, ``"plugins"``, etc.) * ``target_path``: the resolved path string The caller decides what to do with the result — surface a warning to the model, prompt the user, or (with explicit consent / ``cross_profile=True``) proceed anyway. Nrrrrr;)active_profiletarget_profilearear)rr r r r+r"rr1r2r(r)rPROFILE_SCOPED_AREASr?r)r r root_realrrrelrrs rclassify_cross_profile_targetrs""bgg((T34<<>%'//1 %)ND  + IIE  Qx''"Qx aJ J!O !H, ,qQx13N')(6{  G \ " s$ACC3C0/C03 C?>C?cy)uRETIRED (maintainer decision): always returns ``None``. The cross-profile write guard was removed — profiles were never isolated (same OS user; the terminal tool writes anywhere), so the block was ceremony that cost every schema real tokens and taught a bypass arg. The system prompt's active-profile hint remains the only steering; the classifier below survives for that hint and for diagnostics. Kept as a stub so external callers/plugins fail soft. Nrr3s rget_cross_profile_warningr6s r)rr+returnr)rr)rz list[Path])r- str | Pathr.rrbool)r r+rzOptional[Path])r{)r r+rr5)r r+rztuple[set[str], str])r r+rr)r r+rTr+r Optional[str])rir+rr5)rir+rz list[str])rr5)r r+rr)r r+rNone)rr+)rrrrrr+rr)r r+rOptional[dict])rrrr+rr+rrrd)r r+r str | Nonerr)r r+rrrr)2__doc__ __future__rr pathlibr contextlibrtypingrrrrrrr/r4rHrJrQrWrorxrrrrrrrr__annotations__rr rfrrrrrrrrrrrrrrrrrrr sF# 5. 6 ZG02O^&6> 0B9D$kD4 6= aO, [ 5v?[GGLL,-rww||GEU/V .Ab ",$Zc F$r O A<| r