߲jDdZddlZddlZddlZddlZddlmZmZ ddl m Z m Z ddl mZejdZ d4dddd d ed ed edzd ededededzdefdZGddeZdddddddZdddddZded ededzfdZd edefd!Z d5d ed ed ed ededededzdefd"Zd#Zd$edefd%Zd ed ed&ed'eed(ed)eded edefd*Zd+ed&ed efd,Z d-edefd.Z!dd/d0d1d2ed ed edzd)ededef d3Z"y)6aSHuman prompt surfaces for :mod:`tools.approval`. The interactive CLI prompt (callback panel or ``input()`` fallback) and the operator-selected plugin approval transport. Detection, allowed scopes, persistence, timeout policy and the final authorization stay host-owned in ``tools.approval``; this module only asks and reports the answer. N)approval_contextapproval_gateway_wait)activity_heartbeathuman_wait_window)is_interruptedztools.approvalTF) allow_session smart_deniedtitlecommand descriptiontimeout_secondsallow_permanentrr r returnc |tj}t5t||||||||cdddS#1swYyxYw)umPrompt the user to approve a dangerous command (CLI only). allow_permanent=False hides [a]lways (tirith warnings present: broad permanent allowlisting is wrong for content-level findings). allow_session=False hides [s]ession too — the caller grants one operation and re-asks next time (the protected agent-instruction gate in ``tools/file_tools.py``); offering a scope the caller discards makes every later write re-prompt and reads as broken. smart_denied: owner override of a Smart DENY, offer only once/deny. title: header for the plain-input prompt when the question is not a dangerous command ("Save to memory?", " is asking"); the default header stays the dangerous-command one. approval_callback: CLI prompt_toolkit callback ``(command, description, *, allow_permanent=True, allow_session=True, smart_denied=False) -> str``; legacy signatures keep working while both keywords hold their defaults. Returns 'once', 'session', 'always', 'deny', 'timeout', or 'cancelled'. 'timeout' means no user response — still blocked (fail-closed), but callers report "no response" rather than an explicit denial. 'cancelled' is an :class:`Unanswered` sentinel: the prompt never reached a human (callback raised, no callback under prompt_toolkit, interrupted read) and ``.cause`` says why (#22992). See #81887. N)r )_ctx_get_approval_timeoutr _ask_human)r r r rapproval_callbackrr r s :/home/ubuntu/.hermes/hermes-agent/tools/approval_prompt.pyprompt_dangerous_approvalrsT4446  W';+]LPUWWWWs >Ac,eZdZdZdZdeffd ZxZS) UnansweredzChoice ``"cancelled"`` carrying the reason nobody answered. Compares equal to the gateway's withdrawn-prompt choice so every consumer already handling ``cancelled`` fails closed without attributing a denial to the user.)causerc6t||d}||_|S)N cancelled)super__new__r)clsrself __class__s rrzUnanswered.__new__>swsK0  )__name__ __module__ __qualname____doc__ __slots__strr __classcell__)r s@rrr8s )ICr!roncesessionalways)or)sr*ar+zapproval.allowed_oncezapproval.allowed_sessionzapproval.allowed_alwayszapproval.denied)r)r*r+denypromptcddifd}tj|d}|j|j||j rdSdS)zFRead one answer on a daemon thread; None when the user never answered.choicec tjjd<y#ttf$rdd<YywxYw)Nr2r3)inputstriplowerEOFErrorOSError)r0resultsr get_inputz_read_choice..get_inputVsF "$V}224::z#callback_accepts..js'#ePQAFFg.?.?.K.K$K#es,/)rO signature parameters TypeError ValueErroranyvalues)callbackrFparamsrOs @rcallback_acceptsrYbsc""8,77 f  e#eU[UbUbUd#e ee z "sA AAc "ddlm}||} ||} |xs| } |3 d|i|sddini|rddini|rt|drd|ini} || | fi| S dd l m }|"tjd ||t dS dtjd< ddlm}| rdn|rdnd}d|d|}}|xs |d| }t!d|d| d||dt"j$j't)|||}|pt!d|d'it+j,z tjj/ddt!t"j$j'y| riit0j3|dj5dd t0j3|d!j5dd"j7|d"}nt8j7|d"}|d#k(r|sd$}t!|t:||tjj/ddt!t"j$j'S#t$rC} tj d | d t d t| jcYd} ~ Sd} ~ wwxYw#t$rY@wxYw#t<t>f$rjt!dd%zt d&cYtjj/ddt!t"j$j'SwxYw#tjj/ddt!t"j$j'wxYw)(Nrredact_sensitive_textrrFr Tr zApproval callback failed: %sexc_infozthe approval callback failed: )get_app_or_nonezDangerous-command approval requested on a thread with no approval callback while prompt_toolkit is active; failing closed to avoid stdin deadlock. command=%r description=%rzzno approval callback is registered on this thread while prompt_toolkit owns the terminal, so the prompt could not be shown1HERMES_SPINNER_PAUSE)t smart_denylongshortzapproval.prompt_zapproval.choose_zapproval.dangerous_header)r z z z  r>zapproval.smart_deny_once_inputs,r)zapproval.smart_deny_deny_inputsr/r+r*zapproval.cancelledz5the prompt was interrupted before an answer was given)zapproval.timeout) agent.redactr\rY Exceptionloggererrorrtyper""prompt_toolkit.application.currentr_warningosenviron agent.i18nrbprintsysstdoutflushrErapproval_timeout_notice_kwargspopdictfromkeyssplitget_CLI_CHOICE_ALIASES_CLI_CHOICE_I18Nr8KeyboardInterrupt)r r r rrrr r r\display_commanddisplay_description once_onlycallback_kwargser_rbshape prompt_keymenu_keyheaderr2decisions rrrmsz3+G4O/ <1M 1I$ S0/wBO?E":UWw4"8bw7<@PQbdk@l7E"2rtwO%_6I]_] ] G   ( NNPQXZe gOP P )*-BJJ%& ) vg!1%9=MeW;UH Y!7EXY VH)ak]"> ? a m_= > $W1T1T1VWW X -t4  ! $--*K(L(R(RSV(WY_`--*K(L(R(RSV(WY_`#ff- +..vv>H8#O$ a *+, -t4  m S LL7TL J >tAw?O?O>PQR R S*    6 ' (S dQ+,,-QRR -t4   S -t4  s\1I).J8BK=B#K) J528J0*J50J58 KK.M6MMMA Nc.ddlm}m}||S)zCLazy plugin-manager seam used by tests and early tool-only imports.r)discover_pluginsget_plugin_manager)hermes_cli.pluginsrr)r _get_managers rrrsW >r!namecd||||dS)zVResult shape of :func:`_present_with_selected_transport` once a transport is selected.T)selectedr2failurefallbackr)rr2rrs r_attemptrs7PXbf ggr! pattern_key pattern_keys session_keysurfacec &tj\}} |dk(rddiS tj|} | $t j d|t|dd| S d d lm } d d l m } m } tj}| j| |d | |d |t|||||| }t!|j"|j$|t'||d||j(|j*}tj,di|t/|5| | j0||t3dt4}dddj6 |j8nd|j6}tj,di|d|it||j8|j6| S#t$rt j d|d} YwxYw#t$r&t j dt|dddcYSwxYw#1swYxYw)aUPresent through an explicitly selected plugin transport, if any. A selected transport replaces every built-in prompt surface; detection, allowed scopes, persistence, timeout, and final authorization stay host-owned. A failed transport reaches a built-in surface only under the explicit ``transport_fallback: builtin`` opt-in.builtinrFz0Could not resolve selected approval transport %rNz-Selected approval transport %r is unavailabler/ unavailablerr[)ApprovalRequestinvoke_approval_transportT)force) r r rrrrrrr z0Could not build redacted plugin approval requestrkz transport:)r r rrrr request_idrequest_digestz%waiting for plugin approval transport)r on_pollr transport_r2)pre_approval_request)post_approval_response)r_get_approval_transport_configrget_approval_transportrirjrnrrhr\hermes_cli.approval_transportrrrcreatetuplerxr r listrdigest_fire_approval_hookrpresentrrrr2)r r rrrrrrrr registeredr\rrr request hook_kwargsr: hook_choices r _present_with_selected_transportrs88:ND( yE""')@@F FMfmX>>56\446!(()'>-kFT_|,+wfs+_ ) W-@-@k,'[JW[V\J]%%gnnK  C{C ; ' *   &'NO)  $*>>#9&--FNNK[?\KYY[Y D&-- BBM I4P & 5 IJfgt44 5  s0F-"AG%H-!GG,HHHattemptcz|jdsy|jd}|s|jddfS|jddk(r'tjd|jd |yd d lm}|j t j}d|jd |d |||d|fS)aInterpret a ``_present_with_selected_transport`` attempt into ``(choice, denied_result)``: both None when the built-in surfaces should run (no transport selected, or a failure with the explicit builtin fallback); a denied result for any other failure; else the user's choice.r)NNrr2NrrzBApproval transport %r failed (%s); using explicit builtin fallbackrrapprovalz-BLOCKED: Selected approval transport failed (zz); the user has NOT consented to this action. Do NOT retry this command or attempt the same outcome through another route.r)rr outcome) r{rjrntoolsr_denial_breaker_addendumrget_current_session_key_denied)rrr r_abreaker_addendums r_transport_choicers ;;z "kk)$G {{8$d**{{:)+[{{6*G 5$2243O3O3QR  7yA::J9K M [JwiBX  r! unresolvedc|dvry|dvr|SdS)zXMap an approval choice to an elicitation verdict; *unresolved* is the no-answer outcome.)r)r*r+accept)r>rdecliner)r2rs r_consentrs! ..#;;:JJr!zmcp-elicitationzConfirm this action?)r rr messagec lddlm} tj}tjdk(xr,tj xrtj }tjs|r|j|} | t j d|y tj|| ||ddgd | } | jdry| jdr| jdryt!| jddS t#|||d|} t!| dS#t$r }t j d|Yd}~yd}~wwxYw#t$r"}t jd |d Yd}~yd}~wwxYw#t$r"}t jd|d Yd}~yd}~wwxYw)aRoute an MCP elicitation request to the surface owning the active session: gateway sessions through ``_await_gateway_decision``, CLI/TUI through ``prompt_dangerous_approval``. Always fails closed: a missing notify_cb in a gateway session, timeouts, and exceptions map to ``"decline"`` so a server treats them as "user did not approve" rather than retrying or hanging. Returns ``"accept" | "decline" | "cancel"``.rrz.Elicitation consent: session lookup failed: %sNr api_serveru]Elicitation requested in gateway session %s but no notify_cb is registered — failing closedmcp_elicitation)r r rr)rz'Elicitation gateway dispatch failed: %sTr] notify_failedresolvedrcancelr2F)r rr z!Elicitation CLI prompt failed: %s)rrrrrirjrn_get_session_platform_is_cron_approval_context!_is_single_query_approval_context_is_gateway_approval_context_gateway_notify_cb_gw_await_gateway_decisionrkr{rr) rr r rr rrexcapi_run_context notify_cbrr2s rrequest_elicitation_consentrs%224  ""$ 4 9..0 0 9668 8  ((*o))+6   NNHIT V 22YGK8I:K9L)NW^`H << (||J'8<< +D X. ::*7KQ`;@O FH %%Q GM0  LLBCRVL W   8# MsGD."EF. E7EE F#FF F3F..F3)NTNrI)#r%loggingrorsr?rrrrrtools.approval_human_waitrrtools.interruptr getLoggerrjr'intboolrrr|r}rErYrrrxrrrrrrrr!rrsV HK*   + ,]aNR!W7;RW26!Ws!W!WsUYz!W/3!W04!WKO!W&)4Z!W