߲j%6dZddlZddlZddlZddlZddlZddlZddlmZ ddl m Z m Z m Z ejdZdededzfdZd edefd Zdededzfd Zd Zdd ededefdZd edefdZedZej4dZdedefdZdedefdZy)aPre-gate floors for :mod:`tools.approval`: decisions that never reach a prompt. Unconditional blocks (hardline, ``sudo -S`` password piping, the user's own ``approvals.deny`` globs) and the permanent command allowlist match. All of them run BEFORE yolo / ``approvals.mode: off`` / cron approve-mode; the allowlist runs after. Session state stays in ``tools.approval`` and is read through it at call time. N)approval_context)_MALFORMED_EXEC_DESCRIPTION_PARSER_LIMIT_DESCRIPTION_deny_command_variantsztools.approvalcommandreturnc tjjdxsg}|Dcgc]4}t |t s|j s%|j 6}}|syt|D]Q}|jj }|D],}tj||js(|ccSSy#t$rYywxYwcc}w)uReturn the matching ``approvals.deny`` glob, or None. User-defined fnmatch globs that block unconditionally — like the hardline floor, a match fires BEFORE the yolo / mode=off bypass ("never let the agent run this, even under yolo"). Case-insensitive, run over the same normalized/deobfuscated variants the dangerous-pattern detector uses so quoting tricks (``r\m``, ``git st""atus``) can't sidestep a rule.denyN) _ctx_get_approval_configget Exception isinstancestrstriprlowerfnmatch fnmatchcase)r deny_patternspglobscommand_variant candidatepatterns :/home/ubuntu/.hermes/hermes-agent/tools/approval_floors.py_match_user_deny_rulers11377?E2 !. R1As1C QWWY RE R 1':#))+113  G""9gmmo>    Rs"'C CCC CCrcddd|ddS)z@Build the standard block result for an ``approvals.deny`` match.FTz:BLOCKED: this command matches the user-defined deny rule 'u' (approvals.deny in config.yaml). It cannot be executed via the agent — not even with --yolo, /yolo, or approvals.mode=off. Do NOT retry or rephrase this command; the user has explicitly forbidden it.)approved user_denymessage)rs r_user_deny_block_resultr"-s)D 9k k mmc ddlm}|dz dz }|jddtjdz }|j dD]Q}t j t5|jj|kr|jd d d S|d ttjd tjjd d d z }|jd|d|z|j!drdndzddt#|S#1swYxYw#t$$rt&j)ddYy wxYw)uPersist a parser-limit-blocked command as a runnable script. That block fires on payload SIZE/shape, not the operation — usually a legitimate script the model inlined. Saving it makes recovery one turn (`bash `) instead of two, and is strictly safer than the hint-only path: the file goes through the normal execution pipeline (including the referenced-script content guard) and nothing runs here. Returns the path, or None on any failure (hint falls back to write_file).r)get_hermes_homecachezblocked-scriptsT)parentsexist_oki: z blocked-*.shNzblocked--z.shz#!/bin/bash # Auto-saved by Hermes: this command exceeded the inline command # parser limit and was blocked from direct execution. Review it, # then run it via: bash  zutf-8replace)encodingerrorszfailed to save blocked payload)exc_info)hermes_constantsr%mkdirtimeglob contextlibsuppressOSErrorstatst_mtimeunlinkintuuiduuid4hex write_textendswithrrloggerdebug)rr% script_dircutoffoldpaths r_save_blocked_payloadrG6s[4$&03DD 5y(??>2 !C$$W- !88:&&/JJL ! ! !hs499;'7&8$**,:J:J2A:N9OsSS  '(,fB 03: :DKCSCSTXCYR_c eY  4y# ! !$  5 Es+A*D2,.D&B D2&D/ +D22 EEz RECOVERY: this block fires on oversized/unparseable inline command payloads (heredocs, giant one-liners), not on the operation itself. descriptioncd|d}|ttfvr1|r t|nd}|r|td|d|dzz }n |tdzz }dd |d S) z5Build the standard block result for a hardline match.zBLOCKED (hardline): u. This command is on the unconditional blocklist and cannot be executed via the agent — not even with --yolo, /yolo, approvals.mode=off, or cron approve mode. If you genuinely need to run it, run it yourself in a terminal outside the agent.NzYour command was saved to u1 — review it, then run: terminal(command="bash z"). Do not retry inline.zWrite the script to a file with write_file, then run it: terminal(command="bash /path/script.sh") or "python3 /path/script.py". Do not retry inline.FT)rhardliner )rrrG_RECOVERY_PREFIX)rHrr saveds r_hardline_block_resultrMbs {m,K K 02MNN29%g.t  ',UG3efkelm'' G 'D G 4G DDr#cdd|ddS)z5Build the standard block result for sudo stdin guard.Fz BLOCKED: u. Do not pipe passwords to 'sudo -S' — this is a brute-force attack vector. Set SUDO_PASSWORD in your .env file if the agent needs passwordless sudo, or run the sudo command manually in your own terminal.)rr r!)rHs r_sudo_stdin_block_resultrO}s$ K=!` ` bbr#z ;&|<>`$()z:(?:^|[ \t])(?:-[^-\s]*[ce]|--(?:command|eval))(?:[= \t]|$)c|xsd}d}d}d}t|}||kr||}|dk(r'|dk7r"|dz|kr||dznd}|tvrd}|d z }6|||k(rd}nB|d k(r|d vry|tvr0d}n-|d vr|}n&|d k(r|dz|kr||dzdk(ry|tvr|dvry|dz }||kr|y|xrttj |S)aReturn True when a command is too compound for the allowlist shortcut. Quote-aware: metacharacters inside quotes or behind a backslash are literal arguments (``cargo bench -- '^a(b|c)$'``), not shell syntax. Still disqualifying: ``$`` or backtick inside DOUBLE quotes (expansion stays active), and any quoted/escaped control character when the command also carries a ``-c``/``-e``/``--command``/``--eval``-style option that would hand the quoted text to another interpreter.r,NFr\'T")`$)rRrUrW(z())len_SHELL_CONTROL_CHARSbool_REINTERPRETED_ARGUMENT_REsearch)rquotehas_reinterpretableinchnxts r_has_allowlist_shell_operatorrds'mG E A G A a% QZ :%3,$%EAI'!a%.2C**&*# FA   U{#" "2++&*# : E 3Y1uqyWQU^s2 ' 'BdN Q1 a%4   S4(B(I(I'(R#SSr#cddlm}|xsdj}|r t|ry|j5t |j }dddD]Yttrjnds(|k(s,tfddDsBtj|sYyy#1swYhxYw) a True when command_allowlist holds this exact command text or a matching glob. Permanent approvals historically store dangerous-pattern keys such as ``recursive delete``; manual entries are command text, possibly with shell-style wildcards like ``podman *``.r)approvalr,FNc3&K|]}|v yw)Nr!).0rbrs r z7_command_matches_permanent_allowlist..s2QR2=2Qsz*?[T) toolsrfrrd_locktuple_permanent_setrranyrr)r_apatternsrs @r$_command_matches_permanent_allowlistrqs %}"##%G 3G< .**,-.%/%='--/2 7*s2Q52Q/Q3:3F3FwPW3X  ..s B77C)r,)__doc__r5rloggingrer3r<rjrr tools.approval_detectionrrr getLoggerrArrdictr"rGrKrMrO frozensetrZcompiler\r[rdrqr!r#rrzs *TT   + ,33:,mSmTm#3#3:#NS EEcE4E6b#b$b!1'RZZ(ef)T3)T4)TX#$r#