߲jm< UdZddlZddlZddlZddlmZddlmZmZejdZ dAde dd d ejfd Z e d Zeje ed <e dZeje ed<e dZeje ed<e dZeje ed<e ddZeje dzed<ded ej*fdZdej*d dfdZd efdZde d dfdZde d ej*e fdZdej*e d dfdZeej*e ej*e ej*e fZdddd d!e d"e d#e d efd$Zd%ed dfd&ZdBde d e fd'Z de d e fd(Z!d e fd)Z"d efd*Z#e$hd+Z%d efd,Z&d efd-Z'd efd.Z(dCd/Z)d0ed efd1Z*d2Z+d e fd3Z,d e-fd4Z.d e fd5Z/d e0fd6Z1d7e0d e fd8Z2d e-fd9Z3d:e d e fd;Z4d e fd<Z5d e fd=Z6d e fd>Z7d efd?Z8d ee e dzffd@Z9y)DzApproval context: who is asking, from where, under which policy. Session identity and observability contextvars, the interactive/gateway/cron/ unattended predicates, and the ``approvals.*`` config readers used by every gate in :mod:`tools.approval`. N)cfg_get)env_var_enabledis_truthy_valueztools.approvalnamedefaultz str | Nonereturnc0tj||S)Nr) contextvars ContextVar)rrs ;/home/ubuntu/.hermes/hermes-agent/tools/approval_context.py_ctxrs  ! !$ 88approval_session_key_approval_session_keyapproval_turn_id_approval_turn_idapproval_tool_call_id_approval_tool_call_idapproval_session_id_approval_session_idhermes_interactive_hermes_interactive_ctx interactivec<tj|rdSdS)zMBind interactive mode for the current context instead of mutating os.environ.1r)rset)rs rset_hermes_interactive_contextr%s " & &ks BBr BBrtokenc.tj|y)zDRestore the prior value from :func:`set_hermes_interactive_context`.N)rresetr s r reset_hermes_interactive_contextr$*s!!%(rcZtj}| t|StdS)zITrue for an interactive CLI/ACP session (contextvar first, env fallback).HERMES_INTERACTIVE)rgetrr)ctx_vals r_is_interactive_clir)/s+%))+G'.':?7 #ePd@eer hook_namec  ddlm} |jdtj |jdt j tj r$|jdtj ||fi|y#t$rYywxYw#t$r!}tjd||Yd}~yd}~wwxYw)a Invoke a plugin lifecycle hook (pre_approval_request / post_approval_response). Lazy-imports the plugin manager (approval.py is imported long before plugins are discovered). Never raises: approval flow is safety-critical, plugin observability is not. r) invoke_hookNturn_id tool_call_id session_idz$Approval hook %s dispatch failed: %s) hermes_cli.lifecycler, Exception setdefaultrr'rrloggerdebug)r*kwargsr,excs r_fire_approval_hookr75s4M)%6%:%:%<=.*@*D*D*FG  # # %   l,@,D,D,F GI((  M ;YLLMs)BB B" BB" C +CC  session_keyc4tj|xsdS)z ??r>webhook api_servermsgraph_webhookc"ttvS)uTrue when the session platform is a programmatic/unattended surface. Webhook, msgraph_webhook, and api_server sessions bind ``HERMES_SESSION_PLATFORM`` like chat gateways do, but there is no human who can resolve a pending approval. Treating them as gateway approval contexts blocks the session for the full approval timeout (60-300s) and then fails closed anyway — the deadlock in #37284/#87509. )rS_UNATTENDED_APPROVAL_PLATFORMSrRrr(_is_unattended_platform_approval_contextr]s ! "&D DDrc*ttdS)asTrue for a single-query (-q) session: ``hermes chat -q`` exports ``HERMES_INTERACTIVE=1`` (so sudo password prompts work) but nobody is waiting to answer approvals; without this marker the gate would wait the full timeout, fail closed and push the agent toward workarounds (e.g. execute_code). ``approvals.single_query_mode`` makes the path deterministic.HERMES_SINGLE_QUERY_SESSIONrVrRrr!_is_single_query_approval_contextr`s <(EF GGrclts trytdxstt S)aTrue inside a gateway/API session that can answer an approval. Legacy integrations set HERMES_GATEWAY_SESSION; concurrent paths bind HERMES_SESSION_PLATFORM via contextvars. Cron is NEVER a gateway approval context even when it originated from a platform (cron binds the platform for delivery routing): falling through would submit a pending approval with no listener and block the job indefinitely; unattended platforms likewise. Unattended programmatic platforms (webhook, msgraph_webhook, api_server) are excluded for the same reason: those adapters have no ``send_exec_approval`` and no way to receive ``/approve`` replies. Submitting a pending approval there blocks the session for the full approval timeout (60-300 s) with no human who can resolve it (#37284, 87509). Their dangerous-command handling is governed by ``approvals.unattended_mode`` config (default deny), mirroring cron. FHERMES_GATEWAY_SESSION)rWr]rboolrSrRrr_is_gateway_approval_contextrds-!"&N&P 3 4 U=R=T8UUrcD||S ddlm}|S#t$rYywxYw)zXExplicit callback, else the per-thread one from ``terminal_tool.set_approval_callback``.Nr)_get_approval_callback)tools.terminal_toolrfr1)approval_callbackrfs r_resolve_cli_approval_callbackris1$  >%'' s  is_clic0t|xr |duxr|duS)akPrefer the CLI Dangerous Command panel over a silent pending approval: ``HERMES_EXEC_ASK`` (or a platform marker) can leak into an interactive CLI process (historically via ``import gateway.run``), and without a gateway notify listener the ask branch used to return ``pending_approval`` immediately and skip the panel the user can actually answer.N)rc)rjrh notify_cbs r$_should_fall_through_to_cli_approvalrms$ N,D8NY$=N OOr)manualsmartoffct|tr|durdSdSt|trT|jj }|t vr|S|r*t jd|djt y)a!Normalize approval mode values loaded from YAML/config. YAML 1.1 parses a bare ``off`` as False, so ``mode: off`` arrives as a bool; treat it as the intended string mode. Unknown strings (e.g. 'auto') warn and fall back to 'manual' instead of silently failing every mode check.FrprnuFUnknown approvals.mode %r — defaulting to 'manual'. Valid values: %sz, ) isinstancercstrstriplower _VALID_MODESr3warningjoin)mode normalizeds r_normalize_approval_moder{sq $ u383$ZZ\'')  %   NN./3TYY|5L N rc ddlm}|jdixsiS#t$r"}tj d|icYd}~Sd}~wwxYw)uRead the approvals config block: the LIVE config-cache sub-dict (load_config_readonly contract) — callers must not mutate it or any nested structure.rload_config_readonly approvalsz"Failed to load approval config: %sN)hermes_cli.configr~r'r1r3rw)r~es r_get_approval_configrsI:#%))+r:@b@ ;Q? s # AA A Ac ddlm}|x} |jS t t j ddS#t$rY.wxYw)zKReturn 'manual', 'smart', or 'off' (a hosted-room policy overrides config).r)current_room_execution_policyryrn)$gateway.hosted_room_execution_policyr approval_moder1r{rr')r room_policys r_get_approval_moders\ V8: :K G,, , H $$8$:$>$>vx$P QQ    sA A  A c  ttjdd} ddlm}t|}||kDrtjd||t||S#ttf$rYywxYw#t$rd}YJwxYw)aRead ``approvals.timeout`` (default 300s: gateway push notifications may not be seen for minutes; 60s failed closed before Telegram taps landed). Clamped to ``agent.deadline.MAX_SAFE_TIMEOUT_S`` (~1 year): a larger value overflows ``time_t`` inside ``Thread.join`` / ``Lock.acquire`` on macOS and crashed every parallel tool batch; clamping at the single config-read site keeps every consumer platform-safe at once.timeouti,r)MAX_SAFE_TIMEOUT_Si3zGapprovals.timeout=%s exceeds the platform-safe maximum; clamping to %ss) intrr' ValueError TypeErroragent.deadlinerr1r3rwmin)rawrsafe_caps r_get_approval_timeoutrs&(,,Y<=#5)* X~`begop sH   " #"#s"#AA4A10A14 BBsecondsctt|xsdd}|r|dzdk(r|dzd}}n|r|dzdk(r|dzd}}n|d}}|dk(r|d|S|d|d S) uThe ONE human wording for an approval timeout window, shared by the CLI timeout notice, the tool result's ``user_summary`` and the gateway card copy so every surface agrees: 300 → "5 minutes", 90 → "90 seconds", 7200 → "2 hours".rihour<minutesecond s)maxr)rcountunits rformat_approval_windowrs#gl#Q'G7T>Q&ovt Wr\Q&mXtxt % eWAdV B5'4&0BBrc8t}t||dzdS)z``{waited, suggested}`` for the ``approval.timeout`` copy: how long we waited (``5 minutes`` / ``90 seconds``) and a tripled ``approvals.timeout`` value the user can paste into ``hermes config set``.)waited suggested)rr)rs rapproval_timeout_notice_kwargsrs $%G,W5GaK PPrkeyc ddlm}tt|d|dj j }|dvrdSdS#t $rYywxYw)z?Read ``approvals.`` as 'approve' or 'deny' (default deny).rr}rdenyr >rpyesallowapprover)rr~rsrrurtr1)rr~rys r_binary_approval_modersZ:7/1;VTU[[]cce $FFyRFR sAA A AActdS)zERead the cron approval mode from config. Returns 'deny' or 'approve'. cron_moderrRrr_get_cron_approval_moder#s  --rctdS)zRRead the single-query (-q) approval mode from config. Returns 'deny' or 'approve'.single_query_moderrRrr_get_single_query_approval_moder(s !4 55rctdS)uApproval mode for webhook / msgraph_webhook / api_server sessions; default deny — an unattended session never silently runs a flagged action unless the operator explicitly trusts it.unattended_moderrRrr_get_unattended_approval_moder-s !!2 33rc ddlm}|xsijdixsi}|jddrt|jddSdS#t$rYywxYw)z``security.tirith_fail_open`` (default True; True when config is unreadable). False means the operator opted into fail-closed: an un-importable scanner must not silently grant access.rr}securitytirith_enabledTtirith_fail_open)rr~r'rcr1)r~_secs r_tirith_fail_openr4sg:$&,"11*bAGR;?88DTVZ;[tDHH/67eaee sAAA A"!A"c ddlm}|xsijdxsijdxsi}t|jdxsdj j }t|jdxsdj j }|xsd|dk(rdfSd fS#t $rYy wxYw) zCReturn explicitly selected transport and fail-closed fallback mode.rr}rapproval transportbuiltintransport_fallbackr)z config-errorNN)rr~r'rsrtrur1)r~cfgselectedfallbacks r_get_approval_transport_configr@s$:$&,"11*=CHHTZXZsww{+8y9??AGGIsww34:;AACIIK  yx9/D) NN$ NN $$$sB+B== C C )rr )N):__doc__r loggingrMrrutilsrr getLoggerr3rsr rr__annotations__rrrrrcTokenrr$r)r7r:r<tuple_Tokensr?rErKrOrSrW frozensetr\r]r`rdrirmrvr{dictrrrrrrrrrrrrrRrrrsB %2   + ,9s9\9;3I3I9 6::P5Q{--c2Q156H1I;))#.I6:;R6S ..s3S599N4Ok,,S1O ?CCWY]>^//d ;^CC9J9JC )K,=,=)$) fTf M3MTM,881B1B31G8 '[%6%6s%;''  !!#& (9(9#(> @Q@QRU@VV W9;PRfh8#8#8`c8mt8 ((D(:S::)s)s)3s3 @4@"++W!XE$EH4HVdV(PDP[_P* c"dRCRs* CC CC CQQss.. 66 4s4 4  Oc3:o(> Or