߲jq UdZddlZddlZddlmZddlmZddlmZddl m Z m Z m Z m Z ddlmZmZddlmZmZd Zd d hZdZedzed <d ZdZedzed<d ZdefdZdefdZdedzfdZdedzfdZde edffdZ!dededefdZ"d3dedededzfdZ#e$hdZ%de e&e'effdZ(d3ddddedede&dzde'edzdedzf dZ)d Z*d!Z+d3d"e'edededzfd#Z,d3d$e'edededzfd%Z-d3d$e'edededzfd&Z.d3dededzfd'Z/d3dedededzfd(Z0d3dedededzfd)Z1d*Z2ded+edzdededzfd,Z3d4ded-ed+edzde4fd.Z5d/ede&fd0Z6d/ede&fd1Z7d/ede&fd2Z8y)5aqWrite-side safety guards for write_file / patch. Every guard returns ``None`` when the write may proceed, else an error string the tool returns verbatim. Guards, in the order the tools apply them: ``_check_sensitive_path`` (hard deny), ``_check_binary_document_write``, ``_check_protected_instruction_write`` (ALWAYS ask), ``_check_approval_required_write`` (normal gate), ``_check_cross_profile_path`` (sandbox-mirror lost-work), ``_is_internal_file_tool_content``. ``_stale_overwrite_blocker`` (write_file only, under the per-path lock) refuses a whole-file overwrite of content this task never saw or that changed since. N)Path)get_nt_namespace_error) file_state)has_binary_extensionhas_opaque_document_extension is_pdf_pathis_sqlite_sidecar) _expand_tilde_resolve_path_for_task)_has_full_write_baseline_read_mtime_drifted)z/etc/z/boot/z/usr/lib/systemd/z /private/etc/z/private/var/db/z/private/var/root/z/var/run/docker.sockz/run/docker.sock_hermes_config_resolvedF_real_hermes_home_cachedreturncJddlm}t|jS)Nrget_config_path)hermes_cli.configrstrresolvers B/home/ubuntu/.hermes/hermes-agent/tools/file_tools_write_guards.py_config_path_resolvedr4s1  ((* ++chddlm}tjj t |S)Nrget_hermes_home)hermes_constantsrospathrealpathrrs r_hermes_home_realr!9s"0 77  C 12 33rc trtS tS#t$rM ddlm}t tt |dz jcYS#t$rYYywxYwwxYw)zResolved absolute path of the Hermes config file for the ACTIVE profile. Resolved per call so it tracks the per-turn ``HERMES_HOME`` scope (#107327); a test may pin it via ``_hermes_config_resolved`` + ``_hermes_config_resolved_loaded``.rrz config.yamlN) _hermes_config_resolved_loadedrr Exceptionrrrrrrs r_get_hermes_config_resolvedr%>sj &&&$&&    8S!234}DMMOP P   s,  A.8AA. A*&A.)A**A.ctrtS tS#t$rG ddlm}t jjt|cYS#t$rYYywxYwwxYw)aRealpath of the authoritative Hermes home for the ACTIVE profile. Resolved per call so it tracks the per-turn ``HERMES_HOME`` scope (#107327); a test may pin it via ``_real_hermes_home_cached`` + ``_real_hermes_home_loaded``. Consumers exempting a whole TREE want ``_hermes_exempt_homes()``: under a named profile this home is ``/profiles/`` and the root is exempt too.rrN) _real_hermes_home_loadedrr!r$rrrrr rrs r_get_real_hermes_homer(Wsa '' ""    877##C(9$:; ;   s,  A(2AA( A$ A(#A$$A(.c t}|sy ddlm}||}||fStj j ttt|jj}|r ||k7r||fS|fS#t$rd}YnwxYw)u8Realpaths of the Hermes home tree(s) the protected-instruction gate must stay out of: the ACTIVE profile's home, plus the Hermes ROOT when that home is a named profile (``/profiles/``). Exempting only the profile dir left the root's DIRECT files (LEDGER.md / MEMORY.md / SOUL.md / AGENTS.md ...) to the ``.hermes`` component rule, which gated them like a project-local ``/.hermes/config.yaml`` — fail-closed headless (#110630). They are the agent's own store, governed by their own guards, exactly like ``~/.hermes`` under the default profile. The root is added only when the shape really is a named profile (``named_profile_home``), so a coincidental ``profiles/`` dir elsewhere never exempts its parent; the home comes from the ACTIVE scope, never ``HERMES_HOME`` alone.r)named_profile_homeN) r(rr+r$rrr rrparent)homer+ profile_homeroots r_hermes_exempt_homesr0qs ! "D 7)$/ w 77  CS%6 7 > > E EF GDDDLD$<=tg=  sA>> B  B filepathtask_idc\ tt||S#ttf$r|cYSwxYw)zOTask-resolved path string, falling back to the raw input on resolution failure.)rr OSError ValueError)r1r2s r_resolved_or_rawr6s3)(G<== Z s ++ct|d}|r|St||tjj t |f}t d|Drd|dSt}|r ||vrd|dSy) zHReturn an error message if the path targets a sensitive system location.Write)verbc3ZK|]#}|jtxs|tv%ywN) startswith_SENSITIVE_PATH_PREFIXES_SENSITIVE_EXACT_PATHS).0cs r z(_check_sensitive_path..s) eUV1<<0 1 PQ:P5P P es)+z,Refusing to write to sensitive system path: zD Use the terminal tool with sudo if you need to modify system files.z)Refusing to write to Hermes config file: zz Agent cannot modify security-sensitive configuration. Edit ~/.hermes/config.yaml directly or use 'hermes config' instead.N)rr6rrnormpathr anyr%)r1r2nt_err candidates hermes_configs r_check_sensitive_pathrGs$H7 ;F  "8W5rww7G7G V^H_7`aJ eZd ee:8*ER R S 01M*47zBR R S r>soul.md agents.md claude.md .cursorrulesc ddlm}m}|}||ddd}||ddg}t |t sd}t |t sg}||Dcgc]}|st|c}fS#t$rdgfcYSwxYwcc}w)uReturn ``(enabled, extra_patterns)`` from ``security.protected_instruction_files`` / ``security.protected_instruction_extra_patterns`` (fnmatch on basename). Config read failures keep the gate ON — fail-safe for a security boundary.r) load_configcfg_getsecurityprotected_instruction_filesTdefault$protected_instruction_extra_patterns)rrMrNr$ isinstanceboollistr)rMrNcfgenabledextraps r_protected_instruction_configr[s:m#z+HRVWZ)OY[\ gt $ eT " U0aSV0 00 Rx 1s'A+A> A>+ A;:A;rXextra_patternsrXr]c || t\}}|sytjjt |} tjj t t||}tD]+}||k(s#|j|tjzs+y||fD]}tjj|}|j t vst# fd|Dr|cS|j%ddj'dj)d} t+| dk\s| ddk(s|cSy#tttf$r#tjj |}YwxYw)aReturn a short label when ``filepath`` targets a protected instruction file, else ``None``. Matches BOTH the normalized input and its realpath so no symlink direction escapes. Matching runs on BOTH the normalized input path and its realpath so neither a symlink pointing AT a protected file (#41351) nor a protected name that is itself a symlink escapes the gate. ``..`` traversal is neutralized by normpath/realpath before the basename compare. Nc3fK|](}tj|j*ywr;)fnmatchlower)r?pattern base_lowers rrAz0_protected_instruction_reason..s+A\AH GMMO<A\s.1\/z.hermes)r[rrrBr r rr r4r5 RuntimeErrorr0r<sepbasenamera _PROTECTED_INSTRUCTION_BASENAMESrCreplacerstripsplitlen) r1r2rXr] normalizedresolved real_home candidatebasepartsrcs @r_protected_instruction_reasonrvsi.0"?"A !!-"9:J077##C(>x(Q$RS*+ y H$7$7 BFF8J$K!(+  ww *ZZ\ 9 9SA\LZA\>\K!!$,33C8>>sC u:?uRyI5   1 Z .077##J/0s2E 3FFzz7BLOCKED: write to protected agent-instruction file(s) (z) {why} The user has NOT consented to this write. Do NOT retry it or attempt the same edit via another path (terminal, execute_code, etc.).zJapproval prompt timed out without a user response. Silence is not consent.whyzwas denied by the user.rN)get_current_session_key)_await_gateway_decision)prompt_dangerous_approvalprotected_instruction_fileF)command pattern_key pattern_keys descriptionallow_permanent allow_sessiongateway)surface notify_failedzBrequires approval but the approval request could not be delivered. cancelledz1approval was withdrawn before the user answered (z).choicerq)_get_approval_callback)rrapproval_callbackzoncealwayssession)joindictfromkeysformattools.approvalapprovaltools.approval_contextr~tools.approval_gateway_waitrtools.approval_promptrr$_APPROVAL_UNAVAILABLE_lock_gateway_notify_cbsgettools.terminal_toolr _NO_HUMANgetattr)rwr2targetsrdisplayblocked timed_outdenied _approvalr~rr session_key notify_cb approval_datadecisionrtimedrcallbacks r'_request_protected_instruction_approvalrscii g./G 8 B3 37)1%G A'K  #opI ^^ 9^ :F9*BGC *+K __ G!5599+FI G 79:&$" $ +; =Zcd << (>>&j>k k << $>>(YZbcnZoYppr&s>t t X.HLL4L0L  B-/H  >>i>0 0* [%u`hj [ >>'**1&';*O)PPR'T>U U)# V<<9)6)] 9~~"7~889 G G  , H sNF < GG$G6 G$ GGG G G! G!$ G21G2pathsct\syfd|DDcgc]}|r|}}|syt|Scc}w)zGate a write/patch touching protected instruction files. ONE protected file gates the ENTIRE multi-file patch (one prompt, all-or-nothing).Nc3<K|]}t|yw)r\N)rv)r?rZrXrYr2s rrAz5_check_protected_instruction_write..Os(+ 9GWejkk+s)r[r)rr2rrwrXrYs ` @@r"_check_protected_instruction_writerIsX34NGU +$)+1Q./1G1  27G DD 1s ?c 6 ddlm}|Dcgc] }||s |}}|sydjtj |}d|d}d|d} ddlm}|jd |d |d |jd |jd d d|jt } | jdry| jdxs|jd S#t$rYywxYwcc}w#t$r|jt cYSwxYw)zGate a write/patch touching an approval-required path (``~/.ssh/config`` can steer execution via ``ProxyCommand``). Routine gate: once/session/always, honors --yolo, fail-closed without an interactive/gateway channel.r)is_write_approval_requiredNryz$Write to SSH client config file(s): zs. The SSH config can carry ProxyCommand / Match exec directives that run commands, so writes require your approval.z&BLOCKED: write to SSH config file(s) (zf) {why} Do NOT retry it via another path (terminal, execute_code) without the user's explicit consent.r|ssh_config_writerzr{z2requires approval but this cron session denies it.zrequires approval but single-query (-q) sessions run without a user present to approve it. To allow flagged actions in single-query mode, set approvals.single_query_mode: approve in config.yaml.T)rrdisplay_targetcron_deny_messagesingle_query_deny_messageautoapprove_log_prefixfail_closed_when_no_humanno_human_block_messageapprovedmessagez was denied.) agent.file_safetyrr$rrrrrrr_run_approval_gaterr) rr2rrZrdisplay_targetsrrrresults r_check_approval_required_writerVsP@ AQ#=a#@qAGA ii g 67O ..?@9 9 10AB/ / 9* ) )&#O#4A6!..-a.b")..*#1#+ 2"&&~~)~<* >Fzz* ::i EGNN}N$EEK B 9~~"7~889s-C" C1C1C6" C.-C.6DDc ddlm}m}m}m}||}|5|j |xs|j |}ddd7|j jdk(xrtt|dd}|rdSdS|}|j dd k(r|j d d ryy#1swYqxYw#t$rYywxYw) zPReturn the container-side Hermes mirror prefix for persistent Docker file tools.r)_active_environments _env_lock_get_env_config_resolve_container_task_idNDockerEnvironment _persistentFz /root/.hermesenv_typedockercontainer_persistentT) rrrrrr __class____name__rUrr$) r2rrrr container_keyenvpersistent_dockerconfigs r%_get_container_mirror_prefix_for_taskrs  Z Z27;  _&**=9^=Q=U=UV]=^C _ ?!$!7!7;N!N"N%)'#}e*L%M &7? AT A "zz*)fjj9OQU.V  _ _ s3B9%B->B9<B9>B9-B62B99 CCc ddlm}m}t ||}||}||S||t |S#t$rYywxYw)u Soft-guard: warn when ``filepath`` lands on a host-side or Docker sandbox MIRROR of Hermes state (a write the host never reads). Not profile isolation — that guard was removed; ``cross_profile=True`` keeps bypassing this one for replay compat. Fails open.r)get_container_mirror_warningget_sandbox_mirror_warningN) mirror_prefix)rrrr$r6r)r1r2rrrqwarnings r_check_cross_profile_pathrsU^ '2H(2G '@efm@n oo s5 AActjj|dj}t |r d|d|dSt |r d|d|dSt |}|s t|r: tt||} |jr|rd|dSd |d|d S y y #t$rtt|}YDwxYw#t$rYy wxYw) aReject text-tool writes that would corrupt a binary document (read_file showed EXTRACTED text, so the model may write it back). Opaque document formats and SQLite sidecars (-wal/-shm/-journal) are always rejected; .pdf and every other BINARY_EXTENSIONS suffix only when OVERWRITING an existing file (raw PDF syntax is text-authorable and text fixtures named ``*.db`` exist). ``read_file`` auto-extracts .docx/.xlsx/.pptx (and PDF, via anydoc) to readable text, so the model plausibly believes it holds the file's contents and tries to write the edited text back with write_file/patch. A plain-text write can never produce a valid OOXML/OLE/ODF container, so that write silently destroys the document (port of nearai/ironclaw#7109). z1Refusing to write plain text to binary document 'z' (a). A text write cannot produce a valid document container and would corrupt the file (read_file showed you EXTRACTED text, not the real bytes). Use the docx/xlsx/powerpoint skills or a library like python-docx/openpyxl/python-pptx via the terminal to create or edit this document.z7Refusing to write plain text to binary SQLite sidecar 'z). A -wal/-shm/-journal file holds raw database pages that SQLite reads on the next open; text there corrupts the database. Use the sqlite3 CLI or a SQLite library via the terminal to modify the database instead.z$Refusing to overwrite existing PDF 'u' with plain text. read_file showed you EXTRACTED text, not the real bytes — writing text back would destroy the document. Use the pdf skill or a PDF library via the terminal to modify it. (Creating a NEW .pdf file is allowed.)z,Refusing to overwrite existing binary file 'u1) with plain text — read_file showed you extracted or mojibake text, not the real bytes, and writing text back would destroy the file. Use a binary-aware tool via the terminal to modify it (for SQLite databases, the sqlite3 CLI or a SQLite library). (Creating a NEW file with this extension is allowed.)N)rrsplitextrarr rrrr r$r is_filer4)r1r2extpdfrqs r_check_binary_document_writers1 ''  8 $Q ' - - /C$X.?zSER  "EhZsSVRWX   ! h C "8, 528WEFH !>xjI''(C8*CPSuULLM"" ) 5M(34H 5$    s*2B,C C,C  C  CCuFile unchanged since last read. The content from the earlier read_file result in this conversation is still current — refer to that instead of re-reading.rqc tjry|rtj||nd}|r|St||r|dS|r t ||ry t |j }|sy|dS#t$rYywxYw)aReason write_file must NOT replace the existing file, else ``None``. Refuses BEFORE any disk mutation (the pre-#65604 warning arrived after the clobber): a sibling/external/partial-read staleness finding, or an existing file with no full-content baseline for this task (never read in full, read redacted, only patched). Net-new files, files this task fully read (in one page or by paging contiguously to the last line) or wrote, unresolvable paths and the file-state kill switch all let the write proceed. Nzj was modified since you last read it (external edit or concurrent agent). Re-read the file before writing.u" exists but this task has not seen its full current content (never read, only patched, or only a redacted/partial view). Read the file — every page of it, if it needs offset/limit — or use patch for a targeted edit; a stale conversation copy must not overwrite the current disk content.)rguard_disabled check_staler r rexistsr4)r1rqr2stalers r_stale_overwrite_blockerrs  "9AJ " "7H 5tE  8W-jB B C /'Bh&&(  *  sA66 BBreasonc.d|d|dd|d}|r||d<|S)ztModel-facing refusal payload for write_file; ``stale_write_blocked`` lets callers tell it apart from I/O errors.zRefusing to overwrite z: z The file was NOT modified. Reload the current contents with read_file (every page, for a file that needs offset/limit), merge the requested change, then call write_file again. For small edits, prefer patch so existing unrelated changes are preserved.T)errorstale_write_blockedr resolved_pathr*)r1rrqrs r_stale_write_refusalrs> %XJb98 8 $ F"* Mrcontentct|tsy|j}t|xr(t|vxrt |dt tzkS)uTrue when content is the read_file dedup status message, verbatim or lightly framed (contains the full message and is <=2x its length — a real file quoting it would be longer).Frf)rTrstriprU_READ_DEDUP_STATUS_MESSAGEro)rstrippeds r_is_internal_file_status_textr!sQ gs #}}H > >8HD > H S!;<<<>rc t|tsy|jDcgc]}|js|}}t |dkryg}|D]S}|j j d\}}}|s)|js:|jt|Ut |dkst |t |z dkrytdt||ddD}|t |dz k\Scc}w)zTrue for content dominated by read_file's ``LINE_NUM|CONTENT`` display (>=60% of non-empty lines are consecutive numbered lines; a lone ``1|value`` is allowed).Frf|g333333?c38K|]\}}||dzk(sdyw)rNr*)r?prevcurrents rrAz>_looks_like_read_file_line_numbered_content..:s#f-$RY]ade]eReAfsrN) rTr splitlinesrrolstrip partitionisdigitappendintsumzip)rlinelinesnumberedprefixri_restconsecutive_pairss r+_looks_like_read_file_line_numbered_contentr +s gs #%002 CddjjlT CE C 5zA~H)![[]44S9U 6>># OOCK () 8}qCMCJ6<f3x!"3Nff H  1 11 Ds DDc2t|xs t|S)zLReturn True when content is file-tool display text, not intended file bytes.)rr )rs r_is_internal_file_tool_contentr >s ( 1 i5`ah5iirrQr;)9__doc__r`rpathlibrrrtoolsrtools.binary_extensionsrrrr tools.file_tools_pathsr r tools.file_tools_read_trackingr r r=r>rr__annotations__r#rr'rr!r%r(tupler0r6rG frozensetrkrUrVr[rvrrrrrrrrrrrrrr r r*rrrs  4 IX .12DE'+t*!&'+#*+ ,s, 434 S4Z2sTz4>eCHo>0sSSC#cDjL$-.9$: 1uT49_'=1$*<@EI*C*#*.2Tk*26s)d2B*NQTXj*ZW \ H*T#YH*H*]`cg]gH*V Ed3i E# EVY\`V` E+F$s)+Fc+FRUX\R\+F\3sTz( p pc p#PT* p;3;;SSWZ;@= s cDj 3 SVY]S] F3sTzUY$>3>4>222&jCjDjr