߲j UdZddlmZddlZddlZddlZddlZddlZddlm Z ddl m Z m Z ddl mZddlmZmZmZmZmZmZmZmZmZmZddlmZmZmZmZdd lm Z m!Z!m"Z"m#Z#m$Z$dd l%m&Z&dd l'm(Z(m)Z)m*Z*dd l+m,Z,ejZe.Z/e ej`d dZ1e2e3d<ejhZ5iZ6e7e8e7fe3d<iZ9e7e8e:fe3d<e:Z;e:e8e3d<e:Ze7e8e?fe3d<dZ@de?fdZAde8de?fdZBde8ddfdZCde8de8fdZDiZEe7e8eFfe3d<iZGe7e8eHfe3d<de8ddfdZIde8ddfd ZJ dde8d"e8d#e2d$e e8d%e e8de?f d&ZKde8d%e8d'e8de2fd(ZLde8deFe7fd)ZMde8d%e8de2fd*ZNde8d%e8de2fd+ZOde8de2fd,ZPde?fd-ZQde8de7dzfd.ZRde8d/e7fd0ZSde8d1e8fd2ZTde8ddfd3ZUde8d4e2ddfd5ZVde8ddfd6ZWde8ddfd7ZXde8ddfd8ZYde8de2fd9ZZde2fd:Z[de2fd;Z\de:fd<Z]de8d1e8de2fd=Z^d1e8de2fd>Z_d1e8fd?Z`d@e:fdAZade8d"e8dBeFebddfdCZcde:fdDZdiZee7e8e:fe3dE<de8fdFZfde:fdGZgd@e:fdHZhde8de2fdIZide2fdJZjde7fdKZkdLdMdNdOdPdQZlddSe8dTe8de8fdUZmdRdVdWe8d1e8dXe8dSe8dTe8de7f dYZndWe8d1e8dXe8de7fdZZode8dXe8de7fd[Zpde8fd\Zqde8dRe8dXe8d1e8d]eFe8d^e8dzd_e2de7fd`ZredabGdcddZsesdedfdgdhdiZtesdjdkdldmdnZudeFesfdoZvdRe8dpesde7dzfdqZwedabGdrdsZxdtZyduZzexdRdadad!dadvdweyzdxzdydzeyzd{zd|eyzd}zd~ Z{exddadadadaddddezzd{zdd Z|exdd!d!d!d!dvdezzdzddezzdzdd Z}dexdRe8dXe8d1e8d]eFe8de8de2debe7dze2ffdZ~d!dadddexdRe8dXe8d1e8d]eFe8dBeFebde8de2de2de2de2de2de7fdZddebfdZdddddddd!dd d1e8dXe8de8de8dTe8de8de8de8de8de8de2de8de7fdZdde8de2de2fdZdRe8de7dzfdZd!ddRe8de2de7dzfdZ ddRe8de8de2de7fdZdddde8d$e8de8de7fdZde7de8fdZdRe8de7fdZ ddRe8de8de2de7fdZdZdde8de8de2de7fdZegddlZddlZddlZddlZddlZddlZddlZddlZddlZddlZddlZiddddddddddddddÓddœddǓddɓdd˓dd͓ddϓddѓddӓddՓddדddiZdڄZy)acDangerous command approval -- the gate flow and per-session state. Owns the session state (approvals, yolo, gateway queues, denial breaker), the three guard entry points (``check_all_command_guards``, ``check_execute_code_guard``, ``request_tool_approval`` / ``_run_approval_gate``) and the shared human-decision engine behind them. Leaves: ``approval_detection`` (hardline/dangerous patterns), ``approval_context`` (contextvars, config readers), ``approval_floors`` (pre-gate blocks, allowlist match), ``approval_prompt`` (CLI prompt, plugin transports, MCP elicitation), ``approval_gateway_wait`` (blocking gateway round-trip), ``approval_smart`` (guardian LLM), ``approval_human_wait``. Leaves read facade-owned state (``_lock``, queues, denial breaker) back through ``tools.approval`` at call time; sibling-defined names are imported from their defining module. ) dataclassN)Optional)env_var_enabledis_truthy_value)approval_context) _get_session_platform_is_cron_approval_context_is_gateway_approval_context_is_interactive_cli!_is_single_query_approval_context(_is_unattended_platform_approval_context_resolve_cli_approval_callback$_should_fall_through_to_cli_approval_tirith_fail_openget_current_session_key)_approval_key_aliases_check_sudo_stdin_guarddetect_dangerous_commanddetect_hardline_command)$_command_matches_permanent_allowlist_hardline_block_result_match_user_deny_rule_sudo_stdin_block_result_user_deny_block_result)_await_gateway_decision) _present_with_selected_transport_transport_choiceprompt_dangerous_approval)_smart_verdictHERMES_YOLO_MODE_YOLO_MODE_FROZEN_pending_session_approved _session_yolo_permanent_approved_permanent_approved_by_home _denial_tallyreturnc ttjjddS#tt f$rYywxYw)zJ``approvals.denial_breaker_threshold``: default 3; 0 or negative disables.denial_breaker_threshold)intr_get_approval_configget ValueError TypeError3/home/ubuntu/.hermes/hermes-agent/tools/approval.py_get_denial_breaker_thresholdr6DsB#88:>>?Y[\]^^  "s,/AA session_keyc2t5tj|ddz}|t|<tttkDrBtjt t ttttkDrB|cdddS#1swYyxYw)zIncrement and return the session's consecutive guardian-denial count. Pop-and-reinsert keeps actively-denying sessions at the most-recent end so eviction drops idle keys.rN)_lockr(poplen_DENIAL_TALLY_MAX_SESSIONSnextiter)r7counts r5_record_denialrALsv !!+q1A5%* k"- #==   d4 #67 8- #== sA:B B  Bcft5tj|ddddy#1swYyxYw)zDClear the session's consecutive-denial tally (an approval happened).N)r:r(r;r7s r5_reset_denialsrDWs* -+t,---s'0ct5tj|d}dddt}|dks|krytj d|||d|dS#1swY None`` for sending approval requests. The callback bridges sync→async: it runs in the agent thread and must schedule the send on the loop.N)r:rK)r7cbs r5register_gateway_notifyrNzs' .+-K(... #ct5tj|dtj|gD]}|jj  dddy#1swYyxYw)zUnregister the callback and wake ALL blocked threads for this session so they don't hang forever (agent run finished or interrupted).N)r:rKr;rJeventsetr7entrys r5unregister_gateway_notifyrUsV  T2$((b9 E KKOO  s A AA&Fchoice resolve_allreason request_idcVt5tj|}|s dddy|rS|Dcgc]#}|jjd|k(s"|%}}|s dddy|Dcgc] }||vs| c}|ddn0|rt |}|j n|j dg}|stj |d|D],}||_|r||_|jj. dddt|Scc}wcc}w#1swYtSxYw)aWUnblock waiting agent thread(s) from the gateway's /approve or /deny handler. *resolve_all* resolves every pending approval (``/approve all``); otherwise the oldest (FIFO) or the one matching *request_id*. *reason* is the ``/deny `` free text, relayed to the agent in the BLOCKED message. Returns the number resolved. NrrY) r:rJr0datalistclearr;resultrXrQrRr<)r7rVrWrXrYqueuerTtargetss r5resolve_gateway_approvalras ##K0 */^5::>>,3OS]3]u^G^,1I%E4HIE!H 5kG KKMyy|nG    T 2 E!EL% KKOO   '0 w<'_J0 w<s@DD#D D D%D) D3D7BD DD(causec>t5tj|g}tfd|Dd}| dddy|j ||stj |d||_|jjdddy#1swYyxYw)uWithdraw one pending approval nobody can answer (the only attached client cannot render it). The waiter wakes at once with ``cancelled=cause`` — a withdrawal, never a user deny — instead of idling for the whole approvals.timeout (#112548). False when it is no longer pending.c3`K|]%}|jjdk(s"|'yw)rYN)r[r0).0erYs r5 z,withdraw_gateway_approval..s%QA!&&**\*Bj*PaQs#..NFT) r:rJr0r>remover; cancelledrQrR)r7rYrbr_rTs ` r5withdraw_gateway_approvalrjs  ##K4QQSWX =    U    T 2     s/BA BBct5tj|gDcgc]}t|jc}cdddScc}w#1swYyxYw)zEReturn replay-safe snapshots of unresolved approvals for one session.Nr:rJr0dictr[rSs r5list_gateway_approvalsrnsK T.=.A.A+r.RSUUZZ STTSTTsA AA A  Act5tj|gD]1}|jjd|k(s"||_dddy dddy#1swYyxYw)zAttach ``settle(reason)`` to one pending approval; it runs once when that wait ends by any path. False when the request is no longer pending (the surface should withdraw its prompt itself).rYNTF)r:rJr0r[settle)r7rYrprTs r5register_gateway_settlerqsf $((b9 Ezz~~l+z9%      8AAAA%ct5tj|gD]1}|jjd|k(s"d|_dddy dddy#1swYyxYw)zDRecord that a client received a particular pending approval request.rYTNF)r:rJr0r[ acknowledged)r7rYrTs r5ack_gateway_approvalruse $((b9 Ezz~~l+z9%)"     rrcvt5ttj|cdddS#1swYyxYw)zFCheck if a session has one or more blocking gateway approvals waiting.N)r:boolrJr0rCs r5has_blocking_approvalrxs- 6O'' 45666s/8ct5tdtjDcdddS#1swYyxYw)u[Unresolved gateway approvals across every session — a backend blocked on one is not idle.c32K|]}t|ywN)r<)rer_s r5rgz1pending_gateway_approval_count..sD%3u:DsN)r:sumrJvaluesr3r4r5pending_gateway_approval_countr~s5 ED?+A+A+CDDEEEs$5>c|syt5tj|}|s dddyt|djcdddS#1swYyxYw)uCopy of the oldest unresolved gateway approval, for reconnecting clients to restore a prompt. Read-only snapshot — the queue stays authoritative.Nrrl)r7r_s r5get_pending_gateway_approvalrsT  ###K0##E!HMM" ###sA A  AapprovalcLt5|t|<dddy#1swYyxYw)z/Store a pending approval request for a session.N)r:r#)r7rs r5submit_pendingrs$ ) ()))rO pattern_keyct5tj|tj |dddy#1swYyxYw)z(Approve a pattern for this session only.N)r:r$ setdefaultrRadd)r7rs r5approve_sessionrs; J$$[#%8<<[IJJJs .>Acp ddlm}||y#t$rtj d|dYywxYw)aDrop resources whose immutable mode derives from Hermes YOLO. Lazy import so approval-only sessions never load computer-use; releasing on BOTH edges makes enabling YOLO replace a standard backend and disabling it revoke a private unrestricted daemon immediately.r)release_computer_use_sessionzGI++F3X >{ K    sA>C %%C C C%$C%cP|syt5|tvcdddS#1swYyxYw)z?Return True when YOLO bypass is enabled for a specific session.FN)r:r%rCs r5is_session_yolo_enabledr5s(  ,m+,,,s%c,ttdS)zEReturn True when the active approval session has YOLO bypass enabled.r!default)rrr3r4r5is_current_session_yolo_enabledr=s "#:2#F GGr4c&txs tS)zCLI ``--yolo`` (process-scoped, frozen at import) or gateway ``/yolo`` (session-scoped). Hardline / deny-rule floors run BEFORE this everywhere.)r"rr3r4r5 _yolo_activerBs  A ? AAr4cddlm}m}|tS|}tj |}| t }|t|<|S#t$r*}tjd|t}Yd}~9d}~wwxYw)uThe permanent allowlist that governs the ACTIVE profile. Unscoped (single-profile process, or the multiplexer's own launch profile) → the module-level set tests and the CLI seed. A routed profile (HERMES_HOME override) → its own set, lazily loaded from ITS ``command_allowlist``: the launch profile's "always" approvals must not pre-approve commands for a secondary, nor may a secondary's "always" choice be written back into the launch profile's config. Callers hold ``_lock``. rget_hermes_home_overridehermes_home_keyN&Failed to load permanent allowlist: %s) hermes_constantsrrr&r'r0_read_permanent_allowlistrrFrGrR)rrhome_keyapprovedrfs r5_permanent_setrHs|K!)"" H*..x8H 02H19#H- O   NNCQ GuH s A A= A88A=ct|}t5ttj |t zdddt fd|DS#1swYxYw)zSession-scoped or permanent approval. Accepts the canonical key and the legacy regex-derived key so existing command_allowlist entries survive key migrations.Nc3&K|]}|v ywr{r3)realiasrs r5rgzis_approved..ds6Uu 6s)rr:rr$r0rRany)r7raliasesrs @r5 is_approvedr^sY$K0G P!#&7&;&;K&OOP 6g6 66PPs *AA"ctt|}t5td|DcdddS#1swYyxYw)zFPermanent approval only, with compatibility for migrated pattern keys.c34K|]}|tvywr{)r)rers r5rgz+_is_permanently_approved..ksB5N,,BsN)rr:r)rrs r5_is_permanently_approvedrgs6#K0G CB'BBCCCs.7clt5tj|dddy#1swYyxYw)z)Add a pattern to the permanent allowlist.N)r:rr)rs r5approve_permanentrns+ *[)***s*3patternsct5t}|j|j|dddy#1swYyxYw)z2Bulk-load permanent allowlist entries from config.N)r:rr]update)r governings r5load_permanentrts: #"$ "###s ,<Awarningsc|D]X\}}}|dvr t|||dk(s|r!t|t5tt }dddt Zy#1swYxYw)aPersist a human ``session``/``always`` choice for each ``(key, _, is_tirith)``. Tirith findings are session-max by design (no broad permanent allowlisting of content-level findings), so ``always`` downgrades them to session. ``once`` persists nothing.)sessionalwaysrN)rrr:rRrsave_permanent_allowlist)r7rVrkey_ is_tirithsnapshots r5_persist_choicer|so&/Q . .  S) X i c " 1~/0 1 $X ./  1 1s AA( cddlm}|}|jd}t|t}|rddl} |j |}||sg}t|trtd|DrtjdtS|rtjdt|S#|j$rd}Y|wxYw) zY``command_allowlist`` of the active profile's config as a set (empty on malformed input).r)load_config_readonlycommand_allowlistNFc3>K|]}t|t ywr{) isinstancestr)reitems r5rgz,_read_permanent_allowlist..s'RdJtS,A(A'RszBIgnoring malformed command_allowlist; configure a list of strings.zKRecovered legacy string command_allowlist; re-save it as a list of strings.) hermes_cli.configrr0rryaml safe_load YAMLErrorr\rrFrGrR)rconfigrawlegacyrs r5rrs6 ! #F **( )C S !F  ..%C {6 c4 C'Rc'R$R[\u  de s8O~~ C sB00CC_permanent_baseline_by_homec2ddlm}m}|dS|S)Nrrr!)rrrrs r5 _baseline_keyrsJ)+32J9JJr4c  t}t|t5t|tt <ddd|S#1swY|SxYw#t $r*}tjd|tcYd}~Sd}~wwxYw)zLoad ``command_allowlist`` from config and sync it into the approval state so is_approved() honors 'always' choices from previous sessions.Nr) rrr:rRrrrrFrG)rrfs r5load_permanent_allowlistrsm,.x  I;>x= '  8 I I ?Cu s9AA AA A A BA=7B=Bc ddlm}m}|}t|j dgxsg}t 5t }tj |t}|t||z z}t||d<||t|t|<t}|j|j|dddy#1swYyxYw#t$r } tjd| Yd} ~ yd} ~ wwxYw)aSave permanently allowed command patterns to config, reconciling with the file. ``command_allowlist`` is a file an operator edits by hand; removing an entry there is the documented way to withdraw a standing approval. This process read it once at import and ``load_permanent`` only ever unions, so writing the in-memory set straight back deleted entries added on disk since import and resurrected the ones removed. The result written is ``what is on disk now`` plus ``what this process approved since its own baseline``; revoked entries are also dropped from the governing permanent set so ``is_approved()`` stops honouring them. Nothing re-reads the file on the approval hot path. ``patterns`` may only ADD: an entry left out of it is not removed, because the on-disk list wins for anything this process did not approve itself. Remove entries by editing ``command_allowlist`` in config.yaml. r) load_config save_configrNzCould not save allowlist: %s)rrrrRr0r:rrsortedrr]rrrFrG) rrrron_diskrbaselinemergedrrfs r5rrs :>fjj!4b9?R@  %/C266sCEBHH  89F*0.F& '  /26{ ' ,&(I OO    V $ % % % :5q99:s54CB C C CCC D!C<<DcZtxs$t|xstjdk(S)uCanonical three-source bypass check: process ``--yolo`` (frozen at import), the session-scoped gateway ``/yolo`` toggle, ``approvals.mode: off``. Pure bypass sub-expression only — hardline blocklist / permanent allowlist are the caller's job.off)r"rr_get_approval_moderCs r5%is_approval_bypass_active_for_sessionrs*  w!8!E wIYIlIlInrwIwxr4c,ttdS)z?Return whether the current approval context has bypass enabled.r!r)rrr3r4r5is_approval_bypass_activers 01HQS1T UUr4c dddS)NTrmessager3r3r4r5 _approvedrs  ..r4u*You denied this {noun} — it did not run.u6No answer within {minutes} — the {noun} did not run.uGThe approval request could not be delivered — the {noun} did not run.uRThe approval prompt was withdrawn or never reached you — the {noun} did not run.uGThis {noun} is not allowed in an unattended session — it did not run.)deniedtimeout notify_failedriblockedcommandoutcomenounczddlm}m}||}tj |dj ||S)Nr)_get_approval_timeoutformat_approval_windowzThis {noun} did not run.)rminutes)tools.approval_contextrr_USER_SUMMARIESr0format)rrrrwindows r5 _user_summaryrs9T #$9$; G ".(GMD%@;(   kEX{G }UNNUYV[]   7( 7D+AS W[k]"EdVL??CyykJW W F 4 ? Mr4T)frozenc~eZdZUdZeed<eed<eed<eed<eed<defdZd ed ed edefd Zedefd Z y) _UnattendedzGOne non-interactive context and the text every gate uses to explain it.namecfg_keyclausescopetrustr*cHttd|jdS)N_get__approval_mode)rrr selfs r5modez_Unattended.modeQs"Kw'5 >)JKMMr4subjectradvicec hd|d|jd|d|d|jd|jd S)N BLOCKED: z but z. z To allow  z, set approvals.: approve in config.yaml.)r"r#r!)r)r+rr,s r5 block_messagez_Unattended.block_messageUsLG9E$++b 4&PQRVR\R\Q]^!\\N*CE Fr4c|jdj|jddd|jd|jdS)Nrr9z-. Use normal tools instead, or set approvals.z: approve only if .)r"upperr!r$r(s r5 exec_tailz_Unattended.exec_tailYsP;;q>'')*4;;qr?*;<--1\\N:LTZZLXY[ \r4N) __name__ __module__ __qualname____doc__r__annotations__r*r1propertyr5r3r4r5rrHspQ I L K J JNcNFSF3FFF\3\\r4r single_querysingle_query_modez@single-query mode (-q) runs without a user present to approve itzin single-query modez.this single-query run is intentionally trustedcron cron_modez2cron jobs run without a user present to approve itz in cron jobsz*this cron profile is intentionally trustedc g}tr|jttr|jt|St r*|jt dddtddd|S)zActive unattended contexts in evaluation order: single-query first (``hermes chat -q`` exports HERMES_INTERACTIVE=1 but nobody answers); cron beats a platform marker because cron binds the platform for delivery routing only. unattendedunattended_modez-this session runs on an unattended platform (z$) with no user present to approve itzon unattended platformsz2sessions on this surface are intentionally trusted)r append_SINGLE_QUERY_CTXr _CRON_CTXr rr)contextss r5_unattended_contextsrGjszH(*)* " " O 2 3 + %'((L N %'[   Or4ctxcjdk7rydtdtffd }t|\}}}|r;t |s0|d|d}j dk(r|j || |S d d lm}||}|jddvr|t|Sy#t$r/trYyd d jdjddcYSwxYw)aDeny-mode handling for one unattended context (cron / -q / webhook); None = allow. Pattern detection first, then tirith so content-level threats (homograph URLs, pipe-to-interpreter, terminal injection) are caught even when the pattern detector misses. An un-importable tirith honours ``security.tirith_fail_open``: fail-closed means block, since nobody can approve. denyNr+r*c2dj|dddS)NFdangerous commands6Find an alternative approach that avoids this command.rr,r)r1)r+rHs r5blockz_unattended_deny..blocks/!c.?.? .K/@/MN Nr4Command flagged as dangerous ()r<rrrcheck_command_securityFuBLOCKED: the Tirith security scanner could not be imported and security.tirith_fail_open is false, so this command cannot be silently allowed — and zA. Find an alternative approach, install tirith, or set approvals.r0raction)rOwarn)r*rrmrrr rtools.tirith_securityrT ImportErrorrr"r!r0_format_tirith_description) rrHrO is_dangerousrrr^rTtiriths ` r5_unattended_denyr\}s xxzVNsNtN .Fg-N*L+{4[A7 }AFG 88~ % MMk{M K  w@'0zz(00/788  w  ! BBE**NNNQkk]Zs uw wws5B((C = C C c|eZdZUeed<eed<eed<eed<eed<eed<eed<eed<eed <eed <eed <y ) _GateSpecr transportr  redact_clirrgateway_refusedtransport_denied cli_timeout cli_denied smart_logN)r6r7r8rr:rwr3r4r5r^r^sB IOONr4r^a The user has NOT consented to this action. Do NOT retry this command, do NOT rephrase it, and do NOT attempt the same outcome via a different command. Stop the current workflow and wait for the user to respond before taking any further destructive or irreversible action.z The user has NOT consented to this action. Do NOT retry it, do NOT rephrase it, and do NOT attempt the same outcome via a different path.z?BLOCKED: Failed to send approval request to user. Do NOT retry.z+BLOCKED: Command {reason}.{reason_addendum}z{timeout_addendum}{breaker}zBLOCKED: User denied this command through the selected approval transport. The user has NOT consented to this action. Do NOT retry or attempt the same outcome through another route.{breaker}z1BLOCKED: Command timed out without user response.z! Silence is not consent.{breaker}z"BLOCKED: User denied this command. {breaker}z9Smart approval: auto-approved '{command}' ({description})) rr_r r`rrrarbrcrdrecodezLBLOCKED: Failed to send execute_code approval request to user. Do NOT retry.zBLOCKED: execute_code script {reason}.{reason_addendum} The user has NOT consented to running this code. Do NOT retry, do NOT rephrase the script, and do NOT attempt the same outcome via a different tool.{timeout_addendum}{breaker}zfBLOCKED: User denied execute_code through the selected approval transport. The user has NOT consented.z0BLOCKED: Action timed out without user response.uBLOCKED: User denied execute_code script execution (matched '{description}'). Do NOT retry — the user has explicitly rejected it.{breaker}zDSmart approval: auto-approved execute_code for session {session_key}rUz*BLOCKED: Action {reason}.{reason_addendum}z{timeout_addendum} Silence is not consent.uBLOCKED: User denied this potentially dangerous action (matched '{description}'). Do NOT retry — the user has explicitly rejected it.r human_presentct|||||}|dk(rHt|tj|jj |dd||ddd|ddfS|dk7ry t ||ry dd |d t|dd dfS)u3Guardian-LLM step -> ``(result, smart_denied_for_owner)``: a result ends the gate; ``smart_denied_for_owner`` means an interactive owner may still override the DENY for this one operation (once/deny only, nothing persists). APPROVE approves this command only — pattern-level persistence would let one benign command suppress review of later commands in the same broad detector category. A DENY counts toward the denial breaker even when an owner may override it. ESCALATE follows the normal, potentially persistent manual behavior. approveN<)rrr7T)rrsmart_approvedrFrJNF)NTzBLOCKED by smart approval: z@. The command was assessed as genuinely dangerous. Do NOT retry.)rrr)rrDrFrrerrArI)rrrrrr7riverdicts r5 _smart_gaterpsWk; kZG){# T^^**73B<[fq*rs TTZefhmmm&;1+?//G /T.UW     r4)smartpermanent_capable pending_bodyis_cli is_gatewayis_askrqrrc ddlm}d| r!t|||xs| xs| \}||S| r| nd} | xr }dtdtdtffd }d tdtffd }j r\t ||| s| rd nd  |}t|\}}||S|+|dk(rt|jdS||S| s| r:||}|}t}||||| xr  d}rd|d<t||d }|jdr$tjdjS|d |jd}}|jdr|j dd|dddddS|ds|j dd dd!|S||dk(r |j dd"|rd#|d$ndd|S||St#|||%s#j$s|}}t'|||| &S|}}j(r||}|}t ||t+|d '}t-j.d,i|t1||||(}t-j.d-i|d |i|dk(r|j2dS|dk(r'|j dd)t5|d*d+ddd!dS|dk(r|j6dS||S).aAsk a human (after the optional guardian-LLM step) and turn the answer into the gate result. ``warnings`` are the ``(key, _, is_tirith)`` tuples :func:`_persist_choice` stores on session/always. ``permanent_capable`` hides [a]lways when no key could be permanently allowlisted (pure-tirith prompts); a smart-DENY owner override reduces every surface to once/deny and persists nothing. ``pending_body`` is a thunk, built only once a human is actually asked, so a smart APPROVE never pays for redacting a large script. rredact_sensitive_textF)riNtemplaterr*cd}d|vr t}|jdd}d|vrd|ini}t|jd|d|f| jd|S)Nr!rf deny_reasonrX)rbreakerrrrrr3)rIr;rrr) rzrfmtr}r|rrrr7rs r5rJz_human_decision..deny1s ( ".{;GggmT2 08C ,RxW;WSVWA#.K&TYYA:?A Ar4rVcfs t|jr tStSr{)rr r r)rVrr7rrrs r5grantz_human_decision..grant;s0 K :   !+{; ;{r4gatewaycli)rrrrr7surface allow_sessionrrRrJr)rrrrrrTr)rrr~rXriz1approval was withdrawn before the user answered (rQr!)rXreason_addendumtimeout_addendumr|resolvedrztimed out without user responserhzdenied by userz Reason given by the user: "z".)rtapproval_callback notify_cb)rrrrrr)rrrrr7r)rrrzRwas not approved: the approval prompt could not be delivered or was not answered (rbz no answer)pre_approval_request)post_approval_response) agent.redactryrprrmr_rrrArbrrr0rrrrarrrr`r\r_fire_approval_hookrrcrrd) rrrrrrr7rrtrurvrqrrrsryr^rrJrattemptrVrdisplay_commanddisplay_descriptionrr[decisionr|prompt_commandprompt_description hook_kwargsrs ` `` `` @r5_human_decisionrs3L *4+{T`+6fFdPZFd^d f  M%1<>tL'< ,) $$7> !4"k?H[it) <  *1+&N .w72;?~;M[f$($6KY^`K((O;O &~7I[j4@TegF((`[`Y_` D$$i00 D((+&vw DEQH$&9Saeg gDOOX.. =r4ct|}tt}}td}t s t rdx}x}}||||fS)uz``(approval_callback, is_cli, is_gateway, is_ask)`` for the current context. Single-query ``-q`` and cron clear the presence trio: ``hermes chat -q`` exports HERMES_INTERACTIVE=1 for sudo prompts, and a gateway sets HERMES_EXEC_ASK=1 at startup and passes its environ to every external cron worker (#110932) — in neither can a human answer the card, so the gate must resolve from ``approvals._mode`` instead of parking on a pending approval. Unattended *platforms* keep ``is_ask``: api_server relies on it for the ``/v1/runs`` approval bridge (``approval.request`` → ``POST /v1/runs/{id}/approval``).HERMES_EXEC_ASKF)rr r rr r )rrtrurvs r5 _presencersU77HI,.0L0NJF . /F(*.G.I',,,f fj& 88r4flagged actions5Find an alternative approach that avoids this action.) rr+rr,cron_deny_messagesingle_query_deny_messageunattended_deny_messagefail_closed_when_no_humanno_human_block_messagedisplay_targetr+r,rrrautoapprove_log_prefixrrc  tstjdk(r tSt } t | |r tSt |\}}}}|s|s|s | ||f}||| d}tD]}|jdk(r_||j}|s(|jdk(r|jd|ddd }n|s|j||| }t||| cS|jd k(r"tjd g|tcSn/| r,tjd g|t| xsd|d|| Stjdg|tStt||||g|ddfg| |||| S)uShared human-approval gate for a flagged action (tool call or write): decision core for :func:`request_tool_approval` and the file-tool write gates. Order: yolo bypass → session-cache short-circuit → interactive/gateway/unattended branch → prompt → persistence. Input-shape checks (hardline, allowlist, pattern detection) are the caller's job. ``fail_closed_when_no_human``: a non-interactive, non-gateway, non-cron context without an ask bridge BLOCKS instead of auto-approving, so a plugin-flagged action never runs ungated. Unattended deny text is ``ctx.block_message(subject, noun, advice)`` unless the caller passes an explicit ``*_deny_message`` (the file-tool write gates word their own). r)r<r>rArJrAzapproval required (rQrrrNrRr<uZ%s (pattern: %s): %s — single-query auto-approve (approvals.single_query_mode: approve).u%s (pattern: %s): %s — no interactive user/gateway present; BLOCKED (fail-closed). Set HERMES_INTERACTIVE or HERMES_GATEWAY_SESSION to answer the prompt.zBLOCKED: approval required (z>) but no interactive user or gateway is present to approve it.u^%s (pattern: %s): %s — set HERMES_INTERACTIVE or HERMES_GATEWAY_SESSION to require approval.NF) rrrrrr7rrtrurv)rrrrrrrrGr*r r1r rFrGr _ACTION_GATE)rrrrr+rr,rrrrrrr7rtrurvlog_args deny_messagesrHrs r5_run_approval_gaters,~)<<>%G{)+K; ,{4=>O4P1vz6 *V*KE6?P1 () FCxxzV#'1388|#;!//2Ek]RS0T[l7n0pG !//d6/RG[kZZxx>) IUKSU {" ! F$) NZPXZ 6!M2;-@LL +FF E QGO Q{ n+S^!]{D%.H-IWb+FzZ` r4env_typehas_host_accesscn|dk(r| S|dvry ddlm}t||ddS#t$rYywxYw)zTrue when the backend is isolated enough to skip dangerous-command prompts. Docker is the exception once host paths are bind-mounted: ``rm -rf /workspace`` then reaches host files.docker) singularitymodaldaytonavercel_sandboxTr) provider_flagskip_container_guardsF)agent.terminal_env_registryrrwr)rrrs r5_should_skip_container_guardsrsP8"""HH=M(,CUKLL s ( 44cht|}|ytjd||ddt|S)uThe operator's ``approvals.deny`` rules are documented as never bypassable — not by yolo, not by mode=off, and not by an isolated container either: they express intent about what the agent may DO, not what it can reach, so they are evaluated before the container fast path.Nz%User deny rule %r blocked command: %s)rrFrGr)r deny_patterns r5_user_deny_blockrs;)1L NN:L'RVSV-X "< 00r4 sudo_guardrct|\}}|r&tjd||ddt||S|r5t |\}}|r%tjd||ddt |St |S)a0Unconditional floors, BEFORE yolo / mode=off / cron approve-mode so no session-level setting can bypass them: hardline catastrophic commands, password-piping to ``sudo -S`` with no SUDO_PASSWORD configured (full guard only), and the user's own approvals.deny rules ("never, even under yolo").z Hardline block: %s (command: %s)Nrz(Sudo stdin guard block: %s (command: %s))rrFrGrrrr)rr is_hardline hardline_desc is_sudo_guesssudo_guess_descs r5 _floor_blockrs "9!AK9='RVSV-X%mW==)@)I&   NNEX_`dadXe f+O< < G $$r4c t||rt|xs tSt|}||St r tSt |r tSt |\}}}|s tSt||||d|ddddS)zDetect a dangerous command and handle approval (pattern layer only). ``has_host_access``: a Docker sandbox that bind-mounts host paths must not skip approval. Returns ``{"approved": True/False, "message": str or None, ...}``.rrPrQrLrMzFAUTO-APPROVED dangerous command in non-interactive non-gateway context)rrrrr+rr,r)rrrrrrrr)rrrrrrZrrs r5check_dangerous_commandr-s %XO(7IK77#G~{+G4{-Eg-N*L+{ { [du0 Q?FZGg  r4)rule_keyr tool_namerc |xsd|}|s:|dtj|jdjdd}d|d|d}t d ||d |d ||d d |ddd|d S)aEscalate an arbitrary tool call to the human-approval gate. Entry point for a plugin ``pre_tool_call`` hook returning ``{"action": "approve", ...}``: it asks the SAME human gate as Tier-2 dangerous shell patterns (session/permanent allowlist, CLI prompt, gateway pending, once/session/always/deny, timeout fail-closed), so the LLM cannot skip it. Cron honors ``approvals.cron_mode``; any OTHER non-interactive context without an approval bridge fails CLOSED. ``rule_key`` controls the ``[a]lways`` allowlist grain; when empty it is ``tool_name`` + a hash of ``reason`` so DISTINCT reasons on the same tool persist independently. Returns the ``check_dangerous_command`` result shape. zPlugin requires approval for :zutf-8N zTool 'z' requires approval (rQz plugin_rule: (plugin approval rule)zFind an alternative approach.zplugin-escalated tool call 'z(' in non-interactive non-gateway contextTr.zr but no interactive user or gateway is present to approve it. A plugin flagged this action for human confirmation.) rrrrr+r,rrr)hashlibsha256encode hexdigestr)rrXrrrr+s r5request_tool_approvalrGsG;I;GK ['..1C1CG1L"M"W"W"YZ][]"^!_`yk!6{m1EG #8*-;9+%=>Rc ?!=i[Hpq"&"+G95f!f  r4 tirith_resultcXg}|jdxsgD]a}|jdd|jdd|jdd}}}|s<|r|d|n|}|j|rd|d|n|c|s|jd xsd }d |Sd d j|zS)zEHuman-readable severity/title/description summary of tirith findings.findingsseverityr!titlerz: [z] summaryzsecurity issue detectedzSecurity scan: uSecurity scan — ; )r0rCjoin)rpartsfrrdesctextrs r5rYrYes E   z * 0bG !j" 5quuWb7I155Q^`bKc% )-eWBtf%5D LL81XJb/ F G ##I.K2K  ** $))E"2 22r4cz ddlm}||S#t$r!trdgddcYSdddd d d d gd cYSwxYw)zTirith result for the interactive flow; an un-importable scanner allows (default) or, under fail-closed, synthesizes a HIGH warn finding that goes through the normal approval flow (#20733).rrSallowr!)rUrrrVz Tirith unavailable (fail-closed)ztirith-import-errorHIGHz"Tirith security module unavailablezThe Tirith security scanner could not be imported. Because security.tirith_fail_open is false, this command cannot be silently allowed. Approve only if you have verified the command is safe.)rule_idrrr)rUrr)rWrTrXr)rrTs r5 _tirith_scanrssa  @%g..    %2"E E -O,&9E_ ^     s : ::ct||rt|xs tSt|d}||Sddlm}||||}||St j}ts|dk(r tSt|r tSt|\}}} } |s/| s-| s+tD]} t|| } | | cStSt|} t|\}}}g}t}| ddvr\| j!d xsg}|r|dj!d d nd }d |}t#||s|j%|t'| df|r t#||s|j%||d f|s tSdj)d|D}|dd}|Dcgc]\}}}| }}}t+t,||||||||| | |dk(t/d|D Scc}}w)aeRun all pre-exec security checks and return a single approval decision. Tirith and dangerous-command findings are presented as ONE combined approval request, so a gateway force=True replay cannot bypass one check when only the other was shown to the user. ``has_host_access``: a Docker sandbox with bind-mounted host paths takes the normal flow.rTrr)consume_prepared_guardrrU>rVrOrrunknownztirith:Frc3(K|] \}}}| ywr{r3)rerrs r5rgz+check_all_command_guards..s>zq$d>srqc3*K|] \}}}|  ywr{r3)reris_ts r5rgz+check_all_command_guards..sB:1a$hBs) rrrrrr7rrtrurvrqrr)rrrragent.terminal_approval_batchrrrrrrrGr\rrrr0rrCrYrr _COMMAND_GATEr)rrrrrrprepared approval_modertrurvrHr^rrZrrrr7rr tirith_key combined_desc primary_keyrrall_keyss r5check_all_command_guardsrs%XO(7IK77t4GD%gxIH$779M~%/{+G4{4=>O4P1vz6 *V') C%gs3F!  {!)M-Eg-N*L+{H)+KX"33 $$Z06B;C(1+//)Y7wi( ; 3 OOZ)CM)RTXY ZK [Ak59: {II>X>>M1+a.K%-. Q.H. wMh3D*V=T[C[BBB   /s) G(zexecute_code script execution. The script can spawn subprocesses or mutate files without passing through terminal command approval; approval is one-shot for this run.c6 d}t}|dk(r tSt||r tStj}t s|dk(r tSt \}}}} tD]?} | jdk(rtd| jz||dd cStcS|s | s tSt} d d } t| |r tSd d l m tt | |||g|ddfg| |||| |dk( fd S)adApprove an execute_code script before its child process is spawned. The script can call ``subprocess``/``os.system``/``ctypes`` directly, none of which pass through ``terminal()`` / ``DANGEROUS_PATTERNS``; in gateway/ask contexts we fail closed by approving the script as a whole. Same dict contract as ``check_all_command_guards``. Documented limitation: a purely local non-interactive non-gateway session returns approved (the terminal auto-approve contract); the hardline floor still blocks catastrophic ``terminal()`` commands the script issues. See #30882. The hardline floor still blocks catastrophic ``terminal()`` commands the script issues; running arbitrary code headlessly without any approval surface is trusted-by-config (set a gateway/ask surface or ``approvals.cron_mode`` to require approval). See #30882. execute_coderrrrJzyBLOCKED: execute_code runs arbitrary local Python (including subprocess calls that bypass shell-string approval checks). rrgr~zexecute_code <<'PY' z PYrrxNFrqcddS)Nz**Code:** ```python rr3)rgrysr5z*check_execute_code_guard..s56KD6Q5RRWXr4) rrrrrr7rrtrurvrqrs)_EXECUTE_CODE_DESCRIPTIONrrrrrrrGr*rr5rrrryr_EXECUTE_CODE_GATE)rgrrrrrrrtrurvrHr7rrys` @r5check_execute_code_guardrs?!K+K##{$XO{$779M~%/{5>K1vz6$% 88: OQTQ^Q^_'[)Z`  { f{)+K%dV40G; ,{ 3 GR]!]{D%.H-IWb+FzZ`w&X  r4DANGEROUS_PATTERNS)tools.approval_detectionrDANGEROUS_PATTERNS_COMPILED)rrHARDLINE_PATTERNS)rrHARDLINE_PATTERNS_COMPILED)rrHUMAN_WAIT_MARGIN_S)tools.approval_human_waitrcfg_get)zhermes_cli.configrget_plugin_manager)tools.approval_promptrhuman_wait_ceiling)rrhuman_wait_seconds)rrhuman_wait_window)rris_interrupted)ztools.interruptrrequest_elicitation_consent)rr#reset_current_observability_context)tools.approval_contextrreset_current_session_key)rr reset_hermes_interactive_context)rr!set_current_observability_context)rr set_current_session_key)rr set_hermes_interactive_context)rr ctj|}|tdtd|ddl}ddlm}|t|g|t|j|d|dS)Nzmodule z has no attribute r) warn_oncer9) _PLUGIN_COMPAT_LAZYr0AttributeErrorr6rhermes_cli.plugin_compatr rr)r targetrr s r5 __getattr__rBsh $ $T *F ~wxl2DTHMNN2 h&v& *9**6!95vay AAr4)FNN)rr{)Frn)r9 dataclassesrrrloggingos threadingtypingrutilsrrtoolsrrrr r r r r rrrrtools.approval_detectionrrrrtools.approval_floorsrrrrrtools.approval_gateway_waitrtools.approval_promptrrrtools.approval_smartr getLoggerr6rFgetenvr"rwr:Lockr:r#rmrr$rRr%r&r'r(r.r=r6rArDrIrJr\rKobjectrNrUrarjrnrqrurxr~rrrrrrrrrrrrrrrrtuplerrrrrrrrrrrrr r rrrrDrErGr\r^ _STOP_COMMAND _STOP_ACTIONrrrrprrrrrrrrrYrrrr contextlib contextvarsfnmatch functoolsreshlexsystempfiletime unicodedatauuidrrr3r4r5r1s  " 2" @pp/   8 $*)"))4F*KL4L  $sDy/$&4S>&% s3x5S .0T#s(^0!# tCH~" s--- ##2$&c4i%)+T#v+&+..T.3427599="#"s"*."%-c]"*2#"CF"J3CPT"TTT T #$cst6s6t6 EE #c #dTk #))t) JJ3J qS qT q5355$5)S)T) *c*d* st0,,,HH BdB ,7S7s7t7C#C$C*3* #S# / /c /T%[ /T /"3:/1T#s(^0KsK # :s:HysytyV4V/4/;G^eX f3fcf#f \eCSC#CCC#CUXCCkck3kSkTk bb#b$b4C4 !s!!#!!$!48I!EH4Z!"&!+/!L $\\\, 'FL  KM@  d;/&"c" "t "V $$=M  d$5W[SAMQ34 CDmS563mCkQI  4tSW` g qB\Q56 [U#* U%EX]S@<O*+B\Q,- R   i # C c "3i 69 # (-dTk4.?(@ F16.2 J)JJ3J!$J48IJIMeJ!$JAEJSWJ!J*.J(, JKO JZ99$SW#4I"egCHhj FF&)F;>F F F F F=@ F`c F  F =A F cf F  FRC$SW"1c1dTk16;%#%d%td{%$/349SC-1>B4KM`dS#Cim< 3d 3s 3 # $ *045:AcASA.2A?CAJi C3C#CCY]CN   L!#^J!"\  O  / IMMK;"#[*+l !X'(f ()h!"T#$%&b%,Br4