߲j&dZddlZddlZddlmZej dZgdZeddZ dZ de d fd e d fd e d fde dfde ddfgZ dZ dZ dededefdZdedefdZdedeeeeffdZdedefdZdedefdZdedeeeffdZy) zCron prompt threat scanning: the small user-authored prompt gets the strict pattern set; the assembled prompt (with skill bodies) gets only prose-proof directives.N)INVISIBLE_CHARSztools.cronjob_tools))zJignore\s+(?:\w+\s+)*(?:previous|all|above|prior)\s+(?:\w+\s+)*instructionsprompt_injection)zdo\s+not\s+tell\s+the\s+userdeception_hide)zsystem\s+prompt\s+overridesys_prompt_override)zt|tk(r)|dz }|tkrt|tk(r)|dks|tk\rytfd||fDS)zMTrue when the ZWJ at text[idx] sits between emoji codepoints (skipping VS16).rFc3RK|]tfdtDyw)c3\K|]#\}}|tcxkxr|knc%yw)N)ord).0lohiposrs >/home/ubuntu/.hermes/hermes-agent/tools/cronjob_prompt_scan.py z5_zwj_has_emoji_neighbour...Fs* P62rB#d3i. &B & & Ps),N)any_EMOJI_NEIGHBOUR_CP_RANGES)rrrs @r r!z+_zwj_has_emoji_neighbour..Es"UX P5O PPs#')r_VARIATION_SELECTOR_CPlenall)rrleftrights` r _zwj_has_emoji_neighbourr);s 7D !)DJ+AA   !)DJ+AA !GE #d) DK 04J J   #d) DK 04J J ax5CI% ]ach\i promptc`tjdtdd|tjS)uScrub the bundled GitHub skill's `Authorization: token $GITHUB_TOKEN` + api.github.com curl so it doesn't trip the auth-header exfil rule. re.sub scrubs EVERY occurrence. The trailing ``[^\s;&|$`]*`` consumes only the URL path — never separators or subshell openers — so a payload smuggled onto the same line still gets scanned. Host must be exactly api.github.com followed by ``/``, whitespace, quote, or end: lookalike authorities (api.github.com.evil.com, api.github.com@evil.com) fall through. zBcurl\s+[^\n;&|$`]*(?:-H|--header)\s+["\']Authorization:\s*token\s+zJ["\']\s+["\']?https://api\.github\.com(?::\d+)?(?:/|\s|$|["\'])[^\s;&|$`]*z curl https://api.github.com/user)flags)resub_CRON_SECRET_VAR_RE IGNORECASE)r+s r _strip_cron_safe_constructsr2Js8 66 MNaMbcQ Q*mm  r*c|s|gfSt}g}t|D]N\}}|tvr0|dk(r t||s|j dt |d>|j |Pdj|t|fS)zStrip invisible-unicode chars, keeping ZWJ inside legitimate emoji. Returns ``(cleaned, sorted U+XXXX labels removed)``. The skills-attached path sanitizes (a stray zero-width space in vetted skill content must not permanently kill the job). u‍U+04X) set enumerate_CRON_INVISIBLE_CHARSr)addrappendjoinsorted)r+removedcleanedrchs r _strip_invisible_unicoderA\s rzGGV$R & &hC[\bdgCh KK"SWSM* + r  777 VG_ ,,r*c|D];}|D]4\}}tj||tjs,d|dccS=y)Nz(Blocked: prompt matches threat pattern 'zD'. Cron prompts must not contain injection or exfiltration payloads.r6)r.searchr1)r pattern_setspatternspatternpids r _first_pattern_errorrHnsV $ LGSyy$ 6>seDBB  r*ct|}tt|d}tD]%}dt |d|vsdt |ddcSt |t tS)zStrict scan of the USER-SUPPLIED prompt (create/update + runtime defense-in-depth). Returns an error string when blocked, else "". Invisible unicode is reported first, in ``_CRON_INVISIBLE_CHARS`` order (emoji ZWJ allowed).rr4r5z-Blocked: prompt contains invisible unicode U+z (possible injection).)r2r7rAr9rrH_CRON_THREAT_PATTERNS_CRON_EXFIL_COMMAND_PATTERNS)r+prompt_to_scanr>chars r _scan_cron_promptrNysr18N*>:1=>G%i D # 7 *B3t9S/Qgh hi 0EGc ddr* assembledct|\}}|r/tjdt|dj ||t t |tfS)u Loose scan of the ASSEMBLED prompt (skill content included). Invisible unicode is SANITIZED (stripped + logged), not blocked — the hard block stays on raw user prompts, the actual injection surface. Returns ``(cleaned_prompt, error)``, error "" when passed.zaCron skill-assembled prompt: stripped %d invisible-unicode char(s) (%s) from vetted skill contentz, )rAloggerwarningr%r<rHr2_CRON_SKILL_ASSEMBLED_PATTERNS)rOr?r>s r _scan_cron_skill_assembledrTsU0 :GW 5 L$))G, ()DW)MOmn nnr*)__doc__loggingr.tools.threat_patternsrr9 getLoggerrQrJrSr0rKr#r$strintboolr)r2tuplelistrArHrNrTr*r r_s\N K   0 1"7r!:S ))<(=>@PQ()<(=>@PQQReQfgiz{01D0EFHYZPQdPeejknFG  | 3 S T $-S-U3S >-B-$sc ec ec e o# o%S/ or*