߲jT1tdZddlZddlZddlZddlZddlZddlmZddlm Z m Z ddl m Z ejdZedZded efd Zd ed edzfd Zd*d e ded efdZdeded efdZej0dej2ej4zZej0dZej0dZd ed efdZeddDZ ejBdfddfddffZ"d ed efdZ#d ed edzfdZ$d e d!ed"ed#ed e ef d$Z%d ed e d%ed&ed e ed'ed e efd(Z&d ed&ed e ed'ed e ef d)Z'y)+aPre-execution guards for the terminal tool. Pure functions that decide whether a command may run at all: workdir validation, the foreground long-lived/background-operator guidance, the supervised-gateway lifecycle block, and the Windows self-repo git guard. Each ``*_block`` helper returns a finished JSON error string, or None when the command may proceed. Split out of tools/terminal_tool.py; the origin module re-imports every public helper so ``tools.terminal_tool.`` keeps resolving. N)Path)AnyOptional)strip_inert_heredoc_bodiesztools.terminal_toolz /\:_-.~ +@=,chreturnct|rt|dkst|dk(ry|jxs|tvS)N F)ordisalnum_WORKDIR_SAFE_ASCII_CHARS)rs ?/home/ubuntu/.hermes/hermes-agent/tools/terminal_tool_guards.py_is_safe_workdir_charr s3 R2RC ::< :2!:::workdircR|xsdD]}t|rdt|dcSy)zError message if *workdir* has a disallowed character, else None. Allowlist rather than deny-list so novel metacharacters can't slip through.z/Blocked: workdir contains disallowed character z<. Use a simple filesystem path without shell metacharacters.N)rrepr)rrs r_validate_workdirr&sAm$R(A$r(LMM  rcommandlimitc|yt|tr|d|S t|d|S#t$rdt |j dcYSwxYw)z>Return a log-safe preview for possibly-invalid command values.Nz<>) isinstancestrr Exceptiontype__name__)rrs r_safe_command_previewr!2s_'3v-G}Ve$$ -4=))*!,,-s ("A  A errorstatusc:tjdd||ddS)zs ::!evVej kkrz=(?:^|[;&|]\s*|&&\s*|\|\|\s*|\$\(\s*)(?:nohup|disown|setsid)\bz\s&\sz\s&\s*(?:#.*)?$ct|}tjdd|}tjdd|}tjdd|S)uBlank quoted / backtick content and provably-inert heredoc bodies so regex checks can't match keywords (nohup, setsid, '&') inside strings. Heredocs are masked FIRST: their delimiter may itself be quoted (``<<'EOF'``). ``strip_inert_heredoc_bodies`` is conservative — only a quoted, terminated delimiter on a simple opener fed to a known non-shell consumer is masked, so a real background operator can't hide in one. z'[^']*'z''z"(?:[^"\\]|\\.)*"z""z`[^`]*`z``)rresub)rresults r _strip_quotesr0JsF( 0F VVJf -F VV($ 7F 66*dF ++rc#dK|](}tj|tj*ywN)r-compile IGNORECASE).0ps r r7Ys# ( 1bmm(D (s.0)z@\b(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?(?:dev|start|serve|watch)\bz\bdocker\s+compose\s+up\bz\bnext\s+dev\bz\bvite(?:\s|$)z \bnodemon\bz \buvicorn\bz \bgunicorn\bz$\bpython(?:3)?\s+-m\s+http\.server\ba Foreground command uses shell-level background wrappers (nohup/disown/setsid). Re-send WITHOUT the wrapper as terminal(command="", background=true, notify_on_complete=true) so Hermes tracks the process, then run readiness checks and tests in separate commands.cZtj|xstj|Sr2)_INLINE_BACKGROUND_AMP_REsearch_TRAILING_BACKGROUND_AMP_REss rr>ns$+2215^9T9[9[\]9^ruForeground command uses '&' backgrounding. Re-send WITHOUT the '&' as terminal(command="", background=true) — add notify_on_complete=true for bounded jobs — then run health checks and tests in follow-up terminal calls.c4tfdtDS)Nc3@K|]}|jywr2)r:)r5r6r=s rr7z..tsKaahhqkKs)any_LONG_LIVED_FOREGROUND_PATTERNSr<s`rr>r>ts#K+JKKrzThis foreground command appears to start a long-lived server/watch process. Run it with background=true, verify readiness (health endpoint/log signal), then execute tests in a separate command.cdj|jj}d|vxs*|jdxsd|vxs|jdS)zGReturn True for informational invocations that should never be blocked. z --helpz -hz --versionz -v)joinlowersplitendswith)r normalizeds r#_looks_like_help_or_version_commandrJ|sa'--///12JZ &   u % & : % &   u % rcdt|ryt|tfdtDdS)zGuidance text when a foreground command looks long-lived or uses shell backgrounding (it should be a managed background session), else None.Nc3:K|]\}}|s|ywr2)r5hitmsgunquoteds rr7z2_foreground_background_guidance..sKcS]Ks)rJr0next_FOREGROUND_GUIDANCE)rrPs @r_foreground_background_guidancerSs.+73W%H K%9KT RRrenv guard_cwd script_path max_bytesc|y t|j}|jst||z }|jru|j }t j |j rF|j|kr7|j}t||krd|vrdS|jddS |jd|dzdtj|}|jd d d k(r|jd d }|rd|vrdS|S y#t$rYlwxYw#t$rYywxYw)aBest-effort script read: host filesystem first, then a bounded ``env.execute('head -c ... < path')`` for remote backends. Binary content (NUL byte) is not a script: feeding it to the guard tokenizes machine code into bogus paths and crashes the scanner, so it yields None.Nzutf-8replace)errorszhead -c r%z < returncoderr&r)r expanduser is_absoluteis_filestatS_ISREGst_modest_size read_byteslendecoderexecuteshlexquoteget) rTrUrVrW local_pathmetadatadatar/r&s r_read_script_for_guardrpsG  {  +&113 %%'i:5J    !(H||H,,-(2B2Bi2O!,,.t9 )#*d?4^ GT] 8^^ x A c%++k:R9STU ::lB '1 ,ZZ"-F!f&64 BF B -         s1B(D".D"AD1D1" D.-D.1 D=<D=env_typecwd session_keyc~ddlm}ddlm}m}|syddlmm} m} m } m } m } | |r| |r tddS||}|tddxs|}||||| | |fd  \}}|r|rtd |d dS|r(| |r| |r t| dStddSy)u$Refuse gateway lifecycle commands issued from inside the supervised gateway. ``systemctl``/``launchctl``/``hermes gateway restart|stop|uninstall`` targeting hermes-gateway would SIGTERM the gateway — and this very subprocess — before completing, so the service may never come back. Applies unconditionally (``force=True`` cannot bypass it). Gated on the SUPERVISED-gateway probe, not the raw ``_HERMES_GATEWAY`` marker: that marker leaks into every process that merely imports gateway.run (hermes serve, CLI, web server), which must still be able to restart the gateway; an unsupervised foreground ``hermes gateway run`` has no KeepAlive to turn a self-restart into a respawn loop, so it passes too. Returns the JSON error string when blocked, else None. r)_is_supervised_gateway_process)_resolve_command_cwdget_session_cwdN)_MAX_REFERENCED_SCRIPT_BYTESHOST_INTERPRETER_KILL_REJECTIONcontains_host_interpreter_kill!contains_launchctl_submit_command!lifecycle_scan_root_within_budgetscan_gateway_lifecycleaBlocked: launchctl submit/bootstrap is restricted inside a supervised gateway regardless of the job label, to prevent indirect gateway restart loops. This guard does not inspect the job's KeepAlive settings or determine whether it is independent of Hermes. Perform authorized LaunchAgent maintenance from a separate shell outside the gateway, not by switching launchctl verbs to bypass this rejection.r"rr)r default_cwdrsrqc t|Sr2)rp)r6rxrTrUs rr>z)gateway_lifecycle_block..s%;CAOk%lr)rrread_remote_scriptzOBlocked: the lifecycle guard could not scan this command or referenced script: z. Nothing in the command is known to contain a gateway lifecycle command, but a script the command executes must be scannable (a regular text file under 1 MiB) before it can run inside the gateway process.a+Blocked: command or referenced script cannot restart, stop, or uninstall the gateway from inside the gateway process. The gateway would kill this command before it could complete (SIGTERM propagates to child processes). Run `hermes gateway restart` from a separate shell outside the running gateway.)tools.process_registryrutools.terminal_toolrvrwcron.lifecycle_guardrxryrzr{r|r}r+getattr)rrTrqrrrrsrurvrwryrzr{r|r}guard_cwd_baseunsaferefusalrxrUs ` @@rgateway_lifecycle_blockrs ,FI ) +)16WX_6` I   %[1N eT29c$^W_I- lOFG ']^e]fg< <     -W 5:XY`:a !@'J J :     rcddlm}m}ddlm}|sy||||}|||\}} |syt j dt|t| dS)uWindows-only guard against git-mutating the checkout backing this interpreter. NTFS locks loaded module files, so rewriting the live checkout can corrupt the running process; POSIX keeps old inodes alive for open handles, so the guard is off there (``guard_active``). Local backend only — remote backends cannot reach that checkout. Returns the JSON error string when blocked, else None. r)detect_self_repo_git_mutation guard_active)rvN)rr~rsz,Blocked self-repo git mutation (command: %s)blocked) tools.self_repo_guardrrrrvloggerwarningr!r+) rrrrrsrrrvrUrNrOs rself_repo_blockrs[R8 >$W#S^_I,Wi@HC  NNACXY`Cab i ((r))(__doc__r)loggingr-rjrbpathlibrtypingrrtools.shell_heredocr getLoggerr frozensetrrboolrrintr!r+r3r4 MULTILINE_SHELL_LEVEL_BACKGROUND_REr9r;r0tuplerBr:rRrJrSrprrrMrrrsV    :   0 1&o6;c;d; s sTz  -3 -s -S -llclcl (RZZDbmmVXVbVbFb'BJJx0(bjj);< ,3 ,3 ,#( ( O ( # #)) 1 _ ] L 4.SSSS4ZS#RUZbcfZgDS S S S S c] SSc]Sl) ) )c] )  ) c] )r