߲j>< UdZddlZddlZddlZddlmZddlmZddl m Z m Z m Z ejdZdede d e ee ffd Zd efd Zd ed efd ZGddZej*ddZded<d ed dfdZd ed efdZd,dZdefdZded efdZd ed efdZded e efdZdeded e efdZded e efd Z deded!ed e e ee ffd"Z!ded#ed!ed$ed e e ee ff d%Z"d!eded e e ee ffd&Z#ded'e ed e e ee ffd(Z$ded efd)Z%deded e efd*Z&deded!ed e e ee ffd+Z'y)-aWrite/delete guards for ``skill_manage``. Every guard returns ``None`` when the operation may proceed, else a refusal (error dict or message). Origin-owned state (``_find_skill``, ``_skills_dir``) is reached lazily via ``tools.skill_manager_tool`` so test patches keep working.N)suppress)Path)AnyDictOptionalztools.skill_manager_toolmessageextrareturnc d|d|S)NF)successerror)rr s ?/home/ubuntu/.hermes/hermes-agent/tools/skill_manager_guards.py_refusalrsw 8% 88cN ddlm}t|S#t$rYywxYw)zLTrue inside the autonomous curator review fork; False on any lookup failure.ris_background_reviewF)tools.skill_provenancerbool Exceptionrs r_is_background_reviewrs+?(*++ s  $$pathctt5t|jcdddS#1swYt|SxYwN)rrstrresolvers r _resolved_strrs7 ) #4<<>"### t9s 3Ac8eZdZdZddZdeddfdZdedefdZy) _BackgroundReviewReadMarksz@Read marks shared by copied tool contexts within one review run.r NcTtj|_t|_yr) threadingLock_lockset_paths)selfs r__init__z#_BackgroundReviewReadMarks.__init__&s^^% # rrc||j5|jj|dddy#1swYyxYwr)r%r'addr(rs rr+z_BackgroundReviewReadMarks.add*s. ZZ " KKOOD ! " " "s2;cb|j5||jvcdddS#1swYyxYwr)r%r'r,s rcontainsz#_BackgroundReviewReadMarks.contains.s* ZZ '4;;& ' ' 's%.r N) __name__ __module__ __qualname____doc__r)rr+rr.rrrr!r!#s0J&"""'S'T'rr!background_review_read_paths)defaultz9_ctxvars.ContextVar[Optional[_BackgroundReviewReadMarks]]_background_review_read_pathsctsytjx}tjt x}|j t |y)zRecord that the active background-review fork has read a skill file. The fork must not patch content it only inferred from the transcript: skill_view/read_file call this, and the write guards require the mark.N)rr6getr&r!r+rrmarkss r!mark_background_review_skill_readr;7sI ! ".2244=%))3M3O*O%P IImD!"rcjtj}|duxr|jt|Sr)r6r8r.rr9s r_background_review_has_readr=Bs. ) - - /E   D d0C!DDrc>tjty)z@Start a fresh, isolated read set for the current review context.N)r6r&r!rrr#_reset_background_review_read_marksr?Gs!%%&@&BCr skill_pathcddlm} |j}g}|D];}t t5|j ||jfddd=||fS#t$r|}YXwxYw#1swY\xYw)zZ``(resolved skill_path, [(root, resolved_root), ...])`` over every resolvable skills root.r)get_all_skills_dirsN)agent.skill_utilsrBrOSErrorrappend)r@rBresolvedrootsroots r_resolved_rootsrILs5%%' E#%1 g  1 LL$ / 0 1 11 U?  1 1sA#"A4# A10A14A= crddlm}t|\}tfd|D|j S)zXSkills root (local or external_dirs) containing ``skill_path``; local dir if none match.rskill_manager_toolc3LK|]\}}j|s|ywr)is_relative_to).0rHrrFs r z*_containing_skills_root..^s"I'$h.E.Ea.HIs$$)toolsrLrInext _skills_dir)r@_smtrGrFs @r_containing_skills_rootrVZs00%j1OHe IUI4K[K[K] ^^rc |jxst|dxr|jS#t$rYywxYw)u\Symlink or (Windows 3.12+) junction — either lets a poisoned tree redirect rmtree outside. is_junctionF) is_symlinkhasattrrXrDrs r_is_path_redirectr[as@ YWT=%A%XdFVFVFXY s /2 >> skill_dirct|rd|dS |jt|\}}|D]%\}}||k(rd|dcS|j |s%yd|dS#t$r}d|d|dcYd}~Sd}~wwxYw)aLast-line guard before rmtree: even a poisoned tree must never delete (1) a path outside every known skills root, (2) a skills root itself, (3) a symlink/junction (rmtree follows it). ``_find_skill`` already restricts ``skill_dir`` to a real ``SKILL.md`` parent discovered by walking the skills roots, so the agent cannot inject an arbitrary path the way Kilo Code's HTTP endpoint could (their issue 11227: a built-in-skill sentinel resolved to the server cwd and a recursive delete wiped the user's entire working directory). This is the matching defense-in-depth for our agent-facing ``skill_manage`` delete path: even if discovery or a poisoned tree hands us a bad directory, never recursively delete See #11227. zRefusing to delete 'zZ': the skill directory is a symlink/junction. Remove the link target manually if intended.z': could not resolve path (z).NzP': resolves to the skills root itself, which would remove every installed skill.z6': path does not resolve inside any known skills root.)r[rrDrIrN)r\excrFrG_rootrHs r_validate_delete_targetr`is#&yk2QR ST&i0OHe t t *9+6HI J  " "4 (  "),b cc T%i[0KC5PRSSTsA!! A=*A82A=8A=namewhatc ddlm}t|j|j dS#t $rt jd||dYywxYw)zNskill_usage pinned flag; None (logged at debug) when the record is unreadable.r skill_usagepinnedz%s lookup failed for %sTexc_infoN)rRrer get_recordr8rloggerdebug)rarbres r _is_pinnedrlsR%K**4044X>??  .dT Js.1"AAc ddlm}||vrd|dS t |dr d|d |d Sy #t$rtj d|dY9wxYw) aRefusal message if *name* is pinned or essential, else None. Pin only guards DELETION; patches/edits stay allowed. ESSENTIAL_SKILLS are permanently pinned (the system prompt references them). Best-effort: an unreadable sidecar lets the delete through.r)ESSENTIAL_SKILLSzSkill 'z' is essential to Hermes (the agent's own operating manual referenced by the system prompt) and cannot be deleted. Patches and edits are still allowed.z$essential-guard lookup failed for %sTrgz pinned-guardz]' is pinned and cannot be deleted by skill_manage. Ask the user to run `hermes curator unpin zf` if they want to delete it. Patches and edits are allowed on pinned skills; only deletion is blocked.N)rCrnrrjrkrl)rarns r _pinned_guardrosR6 # #$ JK L $$'dV))-/F G H  R ;TD QRs)!A  A actionc tsyd|d}t|drt|d|d|dS dd lm}||rt|d |d S ddlm }|jdf|jdf|jdffD]#\}}||st|d|d |dcS|jj|}|j|s=t!|t"rd|jdnd} t|d |d| d|dS y#t $rt jd |d YwxYw#t $r,t j%d|d t|d |dcYSwxYw)zRefuse autonomous curator writes to anything but curator-owned sediment. The review fork has no user in the loop, so it is also blocked on pinned/external/bundled/hub skills.NRefusing background curator z forzpinned skill guardz pinned skill 'ze': pinned skills are off-limits to autonomous maintenance. Ask the user to run `hermes curator unpin z` if they want it changed.r)is_external_skill_pathz skill 'zl': the skill lives in skills.external_dirs, which are externally owned and read-only to autonomous curation.z)external skill guard lookup failed for %sTrgrdzprotected built-inz hub-installedbundled z'.z created_by= created_byzno usage recordz%': the skill is not curator-managed (zV). User-owned skills are off-limits to autonomous curation. Run `hermes curator adopt z` to opt it in.z&owned skill guard lookup failed for %szd': agent ownership could not be verified because the provenance record is unavailable or unreadable.)rrlrrCrsrrjrkrRreis_protected_builtinis_hub_installed is_bundled load_usager8_is_curator_managed_record isinstancedictwarning) rar\rprefusersre predicatelabel usage_rec_details r_background_review_write_guardrs ! "+F84 8F$,-hodV,F4 67 7W< !) ,((4&)IJK K - X%  - -/C D  ) )? ;  # #Y /!1 E Iu6(!E7(4& CDD  E **,006 55i@HRS\^bHcY]]<%@$CD- ((4&)$$+9-77;fOMN NA G W @$QU VW< X?PTUhhtf%V WX XXs0D=D?D?(A-D?!D<;D<?2E43E4target file_labelc \tr t|rytd|d|d|ddS)zARequire review forks to load the exact target before mutating it.Nrrz for skill 'z': the current z content has not been loaded in this review turn. Call skill_view(name) for SKILL.md, or skill_view(name, file_path=...) for a supporting file, then retry the write using the content just returned.T)_read_before_write_required)rr=r)rarrprs r*_background_review_read_before_write_guardrsF ! "&A&&I  &vhl4&PZ|\! "%)  **rcb|dvryddlm}|j|}|rt||d|SdS)N>editpatchdelete write_file remove_filerrKr)rRrL _find_skillr)rprarUexistings r_background_review_preflightrs> MM0%HMU )$0@& I_[__r absorbed_intoctr t|tr|jryt d|d|ddS)uFail closed on unverified deletes during the curator consolidation pass. The fork's only legitimate delete is a consolidation declared via ``absorbed_into=`` (existence validated in ``_delete_skill``); the deterministic inactivity prune never calls skill_manage, so a bare delete here can only be the LLM pass pruning without evidence. A delete with no forwarding target — ``absorbed_into`` omitted (``None``) or empty (``""``) — is the fail-open behavior reported in #29912: the consolidation pass archived whole clusters of active skills with zero verified consolidations (``consolidated_this_run == 0``), leaving active automations pointing at names that no longer resolve. Refuse it; keep the skill active. Nz-Refusing background curator delete of skill 'uP': the consolidation pass may only archive a skill it has absorbed into an umbrella. Pass absorbed_into= (the umbrella must already exist) to record a verified consolidation. Pruning a skill with no forwarding target is not permitted here — the deterministic inactivity prune handles staleness archival separately. Keeping 'z ' active.T) _fail_closed)rr|rstripr)rars r#_curator_consolidation_delete_guardrsN ! "z-'E-J]J]J_  7v>348&  C   rcHddlm}ddlm}|||j S)Nr)is_org_mirror_pathrK)rCrrRrLrT)r@rrUs r_is_org_mirrorrs40 j$*:*:*< ==rc$ ddlm}t|sy|jsd|dSddlm}||}|j drd|j d d Sy #t$r'}tjd ||d |dcYd}~Sd}~wwxYw)zSubmit an org-skill edit upstream when `sync.org_auto_propose` is on. Returns a note for the tool result or None; never raises (the edit is saved locally and can be proposed later).r)skills_sync_clientNzThis skill is shared by your organisation. Your edit is saved locally and will not be overwritten by org updates. Run `hermes sync propose z` to share it back.) propose_skillproposal_pendingz0Auto-proposed to your organisation as proposal # proposal_idz (pending admin review).z@Auto-proposed to your organisation (merged into the shared set).zauto-propose skipped for %s: %sudEdit saved locally. Could not submit it to your organisation right now — run `hermes sync propose z ` to retry.) rRrrsync_org_auto_proposetools.skills_sync_client_orgrr8rrjrk)rar@sscrresultes r_maybe_auto_propose_org_editrsI3j)((*,,061DF G ?t$ ::( )JJ}-..FH IR I 6a@66:V; H IIs'AA3A B(B B Bc |dvry t|rtd|d|d|dS y#t$rtj d|d YywxYw) ugOrg-shared skills are EDITABLE IN PLACE — this only blocks deletion. Edits land in the mirror, survive the next org pull (baseline sidecar in skills_sync_client) and reach the org via `hermes sync propose`. Deletion stays refused: the mirror is a view of org HEAD, so a local delete just comes back, and removing for everyone is an admin action.>rrNzCannot z 'u' locally: it is shared by your organisation, so a local delete would just come back on the next sync. Ask an org admin to remove it for everyone. (Editing it IS allowed — your changes are kept and can be proposed back with `hermes sync propose z`.)z%org mirror guard lookup failed for %sTrg)rrrrjrk)rar@rps r_org_mirror_write_guardr(s~ ..S * %&D6*237s<= = &  S 
rs! &&   5 69c9C9DcN9t ' '"H6EZG#D#T#EdEtE D  ___DTdtd d8S *5 55(+508c3h0H5p *  * *%( *69 *>FtCQTH~>V *``C`HT#s(^t>> IsII#I4#4RVWZ\_W_R`Iar