+ iHjoa na0t$Rt^RIHt^RIt^RIHt^RIHt^RI H t RRlt RR lt R R lt R R ltRRltRRltRRltRRRRlltRRltRRltRR/RRlltRRltRStR R!ltR"R#ltR$R%ltRTtR&R'/R(R)lltR*R+ltR,R-ltRR.R&R'/R/R0lltR1R2lt 0RUmt!R4]"R5&R6t#R7R8R9R3R:]PHPKR;R<4]PHPKR=R>43t&RVt'R?R@lt(RARBlt)RCRDlt*REt+RFRGlt,RHRIlt-RJRKlt.RLRMlt/RWRNROllt0RWRPRQllt1R#)XaShared file safety rules used by both tools and ACP shims. Every guard here is defense-in-depth, NOT a security boundary: the terminal tool runs as the same OS user and can read/write anything. The value is a clear denial for models that respect tool errors plus a visible audit trail. ) annotationsN)Path)suppress)Optionalc V^8dQhRRRR/#) getter_namestrreturnr)formats"6/home/ubuntu/.hermes/hermes-agent/agent/file_safety.py __annotate__rs5555c^RIp\W4!4# \d,\\P P R44u#i;i)zeCall ``hermes_constants.()`` (local import avoids cycles); ``~/.hermes`` on any failure.Nz ~/.hermes)hermes_constantsgetattr Exceptionrospath expanduser)rrs& r _constants_pathrsB5'577 5BGG&&{3445s3A  A cV^8dQhRR/#rr rr )r s"r rrs..4.rc\R4#)z@Active HERMES_HOME (profile-aware). Tests monkeypatch this name.get_hermes_homerr rr _hermes_home_pathrs , --rcV^8dQhRR/#rr )r s"r rrs6646rc\R4#)z;Hermes root dir (parent of any profile, never per-profile).get_default_hermes_rootrr rr _hermes_root_pathr!s 4 55rcV^8dQhRR/#rr z list[Path]r )r s"r rr$sZZjZrc t\\P\\ 4\ 43444#)zResolved active HERMES_HOME and global root, deduplicated. Both are checked so credential stores at /... stay guarded when running under a profile (HERMES_HOME = /profiles/). )listdictfromkeys _resolve_eachrr!r rr _hermes_dirsr)$s*  m->-@BSBU,VWX YYrcV^8dQhRR/#r#r )r s"r rr-sJrc.pVFBp\\4;_uu_4VPVP44RRR4KD V# +'giKY;i)zB``p.resolve()`` for each path, skipping ones that fail to resolve.N)rrappendresolve)pathsoutps& r r(r(-sIC  i JJqyy{ #!  J! s A  A c$V^8dQhRRRRRR/#)rresolvedz str | Pathbaser boolr )r s"r rr6s&GG G*GGrc\V\4'dVPV4RJ#W8H;'g0VP \ V4\ P,4# \dR#i;i)zTrue when ``resolved`` equals ``base`` or lies below it (both already resolved); ``Path`` inputs use ``relative_to`` (platform semantics), ``str`` a realpath prefix test.NF) isinstancer relative_to ValueError startswithr rsep)r2r3s&&r _is_underr;6sk(D!! ''-T9 9   F Fx223t9rvv3EFF  sA&& A54A5c V^8dQhRRRR/#)rrr r zOptional[Path]r )r s"r rrAs#.rc \\\4;_uu_4\\P P \V444P4uuRRR4# +'giR#;i)zD``Path(expanduser(path)).resolve()``, or None when resolution fails.N) rOSError RuntimeErrorrrrrr r-rs&r _resolve_targetrAAsE '< ( (BGG&&s4y12::< ) ( ( ( s ?A'' A8 c V^8dQhRRRR/#)rrr r set[str]r )r s"r rrHs00s0H0rc&\PPR40p\\4;_uu_4^RIHpHpHpV!4V!4V!43F'pV'gK VP\V44K) RRR4\V4p\V4^8dVPR4'dV^,R9dVR,PR^4^,PR^4^,p\PPRV 24pVPR4'gVPV4VU u0uF"p \PPV 4kK$ up # +'giEL;iuup i)uEvery home the write guards must cover. Process ``~`` alone is wrong whenever the process HOME is not the OS user's real home — ``TERMINAL_HOME_MODE=profile``, containers, and spawned workers pin ``HOME`` to ``{HERMES_HOME}/home``, which leaves the real home's credential paths unguarded against absolute-path writes while file tools happily write there (and ``_expand_tilde`` may route ``~`` to yet another home). Deny/approval lists are built over the union: process home, real home, subprocess home, and the profile home. A ``~name/...`` input resolves to a named account's home, which joins the set so ``~root/.ssh/authorized_keys`` stays denied.~) get_real_homeget_subprocess_home_profile_home_pathNz/\:NN/\)rrrrrrrFrGrHaddr lenr9splitrealpath) rhomesrFrGrH candidaterawnameexpandedhs & r _guard_homesrVHs'WW   $ %E )  [['/+>+@BTBVWIy #i.)X  d)C 3x!|s++Ae0C2w}}S!$Q'--dA6q977%%$j1""3'' IIh ). /ABGG  Q  //    0s'E:$E:(F: F c V^8dQhRRRR/#)rrr r ztuple[set[str], str]r )r s"r rrasOOcO&:Orc\V4\PP\PP \ V4443#)uR``(guard homes, realpath(expanduser(path)))`` — the write-guard coordinate pair.)rVrrrOrr r@s&r _homes_and_resolvedrYas4  rww//0B0B3t90MN NNrc V^8dQhRRRR/#rrr r r4r )r s"r rrsstrc`\V4PRR4pVPR4'dR#VPR4'dR#VPR4'dJVR,pVP4pVPR4'gVPR 4'dR#R #) uReturn True if ``path`` is a Windows NT-/device-namespace path. Checks the raw string only — never resolves the path (resolving is the credential-leak trigger this guard exists to prevent). rJrKz\??\Tz\\.\z\\?\:NNzUNC\z GLOBALROOT\F)r replacer9upper)rsrestr_s& r is_nt_namespace_pathrbs D #t$A||H||I||Iu    G $ $(8(8(H(H rverbAccessc$V^8dQhRRRRRR/#)rrr rcr Optional[str]r )r s"r rrs!   s - rc8\V4'gR#V RV R2#)zCReturn an error message when ``path`` uses the NT/device namespace.N denied: 'a' uses a Windows NT/device namespace prefix (\??\, \\.\, \\?\UNC\, or GLOBALROOT). These paths bypass normal path normalization and can trigger outbound SMB authentication (NTLM credential leak) merely by being resolved. Use a normal absolute path instead.)rb)rrcs&$r get_nt_namespace_errorris*  % % & 4&!. .rc V^8dQhRRRR/#rhomer r rCr )r s"r rrs003080rclaR pRR\PPRR4\PPRR4\PPRR43p.V3RlV4OR V4OR NR NR NpVUu0uF"p\PPV4kK$ up#uupi)z8Return exact sensitive paths that must never be written..env.anthropic_oauth.jsonauthgoogle_oauth.jsoncachebws_cache.jsonzbws_cache.enc.jsonc3h<"TF'p\PP!S.VO5!xK) R#5iN)rrjoin).0frls& r +build_write_denied_paths..s& 5*Q"'',,t a *s/2c3z"TF1p\4\43Fp\W!, 4xK K3 R#5iru)rr!r )rwrxr3s& r ryrzs. eA;L;NPaPc:d$#dh--:d-s9;z /etc/sudoersz /etc/passwdz /etc/shadow)).sshauthorized_keys)r|id_rsa)r| id_ed25519)z.netrc)z.pgpass)z.npmrc)z.pypirc)z.git-credentials)rrrvrO)rl home_files hermes_filesr.r0sf r build_write_denied_pathsrs J '  V01  W./  W23 L   5* 5  e e   & (5 E */ /ABGG  Q  // /s(B1c V^8dQhRRRR/#)rrlr r z list[str]r )r s"r rrs99c9i9rca.V3Rl\4ORNRNpVUu.uF7p\PPV4\P,NK9 up#uupi)z?Return sensitive directory prefixes that must never be written.c3<"TF6p\PP!S.VPR4O5!xK8 R#5i)rJN)rrrvrN)rwdrls& r ry.build_write_denied_prefixes..s0 J5I"'',,t +aggcl + +5Is>Az/etc/sudoers.dz /etc/systemd)HOME_CREDENTIAL_DIRSrrrOr:)rlr.r0sf r build_write_denied_prefixesrs]  J5I J  ( E38 8%QBGG  Q "&& ( (% 88 8s=AcV^8dQhRR/#)rr rCr )r s"r rrshrc \4p\R\P!RR4P \P 44Fsp\ \\4;_uu_4VP\PP\PPV444RRR4Ku V# +'giK;i)zFResolved HERMES_WRITE_SAFE_ROOT paths (``os.pathsep``-separated list).NHERMES_WRITE_SAFE_ROOT) setfilterrgetenvrNpathseprr>r8rLrrOr)rootsrs r get_safe_write_rootsrseEtRYY'?DJJ2::VW gz * * IIbgg&&rww'9'9$'?@ A+ *X L+ * *s (A C C c V^8dQhRRRR/#rkr )r s"r rrsDDSDXDrc\PP\PPVRR440#)aePaths that need human APPROVAL to write but are not hard-denied credentials. ``~/.ssh/config`` is routine to edit and holds no key bytes, but can carry ``ProxyCommand`` / ``Match exec``. Interactive file tools prompt (approve-once/session/always, like the terminal tool's ``~/.ssh`` gate); non-interactive callers (ACP shims, background jobs) fail closed. r|config)rrrOrv)rls&r build_write_approval_pathsrs- GG  RWW\\$A B CCrentryFc$V^8dQhRRRRRR/#)rrr rr4r rfr )r s"r rrs!>>>>>rc\V4'dR#\V4wr#^RIHpHpV!V4'gV'dV!VRR7'dR#\ W#4pV'g V'gV#V!\ PP\V444wrx\ PP\ PPT;'gR4V4p \ W)4#)u0Return ``'credential'``, ``'safe_root'``, ``'nt_namespace'``, or ``None`` if writes are allowed. ``entry=True`` is for ops that unlink/rename the directory entry itself (a symlink, not its target): the entry — parent realpath'd, final component kept — is vetted as well as the target it resolves to. nt_namespace)is_protected_path split_entryF)follow credential.) rbrYagent.runtime_self_protectionrr_classify_resolved_write_denialrrrr rvrO) rrrPr2rrdenialparentleaf entry_paths &$ r _classify_write_denialrsD!!)$/OE M5->tE-R-R ,U =F U rww11#d)<=LFbgg..v}}=tDJ *5 ==rc$V^8dQhRRRRRR/#)rrPrCr2r r rfr )r s"r rrs!8s}rc$a\;QJdV3RlV4F 'gK RM RM!V3RlV44'dR#\;QJdV3RlV4F 'gK RM RM!V3RlV44'dR#\4Fp\Fp\\4;_uu_4\ S\ PP\ PP\V4V444'dRRR4R#RRR4K K \4pV'dC\;QJdV3RlV4F 'gK RM RM!V3RlV44'gR#R# +'giK;i) zPCredential / protected-subpath / safe-root verdict for an already-resolved path.c3@<"TFpS\V49xK R#5irurrwrlr2s& r ry2_classify_resolved_write_denial..s JED81$7 7ETFNc3<"TFgpS\V49;'gM\;QJd(V3Rl\V44F 'gK RM RM!V3Rl\V444xKi R#5i)c3F<"TFpSPV4xK R#5iru)r9)rwprefixr2s& r ry<_classify_resolved_write_denial...!s![9Zvx""6**9Zs!TFN)ranyrrs& r ryrsc D ,T22 \ \ 3[9TUY9Z[333[9TUY9Z[ [ \sA2 A2A2 )A2rc3<<"TFp\SV4xK R#5irur;)rwrootr2s& r ryr-sOJDi$77Js safe_root) rr)_HERMES_PROTECTED_SUBPATHSrrr;rrrOrvr r)rPr2r3sub safe_rootss&f r rrs s JE Jsss JE JJJ s  sss   -C)$$Xrww'7'7 SYPS8T'UVV'%$V%$. &'J##OJO###OJOOO %$$s 3AE> > F c V^8dQhRRRR/#r[r )r s"r rr3s44#4$4rc\V4RJ#)zBReturn True if path is blocked by the write denylist or safe root.N)rr@s&r is_write_deniedr3s !$ 't 33rWritec(V^8dQhRRRRRRRR/#)rrr rcrr4r rfr )r s"r rr8s/ a a as aT aVc arc\WR7pVR8Xd<\PP\ \ 444pV RV RV R2#VR8Xd \ WR7#V'd V RV R2#R #) zuReturn a user/model-facing error when writes to ``path`` are blocked (``entry``: see :func:`_classify_write_denial`).)rrrhz%' is outside HERMES_WRITE_SAFE_ROOT (z:). Unset the variable or add this path's directory prefix.rrcz(' is a protected system/credential file.N)rrrrvsortedrri)rrcrr roots_displays&$$ r get_write_denied_errorr8s$D 6F  /C/E(FG fJtf%X Z %d66PVdV:dV#K L`\``rc V^8dQhRRRR/#r[r )r s"r rrGsOOSOTOrca\V4wpo\;QJdV3RlV4F 'gK R# R#!V3RlV44#)zTrue if ``path`` is approval-gated (``~/.ssh/config``): interactive callers prompt, callers without a channel treat it as a block (fail closed).c3@<"TFpS\V49xK R#5irurrs& r ry-is_write_approval_required..KsNx5d;;rTF)rYr)rrPr2s& @r is_write_approval_requiredrGs<*$/OE8 3NN33N3N3NN NNrrnrC_BLOCKED_PROJECT_ENV_BASENAMESuT (Defense-in-depth — not a security boundary; the terminal tool can still bypass.)z auth.jsonz auth.lockrozwebhook_subscriptions.jsonrprqrrrsc V^8dQhRRRR/#rrr r rfr )r s"r rrps.A.As.A}.Arcaaa\VRR7pV'dV#\V4P4P4o\ 4oRp\ ;QJdV3RlS4F 'gK RM RM!V3RlS44'dRpM\ ;QJd$VV3Rl\ 4F 'gK RM RM!VV3Rl\ 44'dR \,pM\FVwor4\V3R lS44F-p\SV4'gKSV8XdTMT\,pM V'gKVM Vf1SPP4\9dR \,pV'd R V R V 2#R#)aJReturn an error message when a read targets a denied Hermes path. Blocked: internal skill-hub caches (prompt-injection carriers), credential stores under HERMES_HOME and the global root (exact files, plus anything under ``mcp-tokens/`` and ``browser-profile/``), and project-local ``.env`` files anywhere on disk (``.env.example`` is the documented-shape substitute). Callers that resolve relative paths against a non-process cwd (e.g. ``TERMINAL_CWD``) MUST pass an absolute path: ``resolve()`` here anchors at the process cwd, so a relative ``"auth.json"`` would miss the denylist. ReadrNc3X<"TFp\SVR, R, 4xK! R#5i)skillsz.hubNr)rwhdr2s& r ry'get_read_block_error..s$ M29XrH}v5 6 6s'*TFzis an internal Hermes cache file and cannot be read directly to prevent prompt injection. Use the skills_list or skill_view tools instead.c3V<a"TFoS\V3RlS449xK R#5i)c34<"TF qS, xK R#5irur )rwrrSs& r ry1get_read_block_error...s&G;RDyy;N)r()rwrS hermes_dirsr2s&@r ryrs# kTjDX&G;&GG GTjs%)z}is a Hermes credential store and cannot be read directly. Provider tools consume these credentials through internal channels.c34<"TF qS, xK R#5irur )rwrsubdirs& r ryrs,O;R&[[;rzis a secret-bearing environment file and cannot be read to prevent credential leakage. If you need to check the file structure, read .env.example instead.zAccess denied:  )rirrr-r)r_CREDENTIAL_FILE_NAMES _DID_SUFFIX_READ_DENIED_DIRSr(r;rSlowerr) rnt_errorreasondir_msgfile_msg blocked_dirrr2rs & @@@r get_read_block_errorrpsF"&d8HDz$$&..0H.K F s M Msss M MMM Q   kTj k kTj k k k CEP Q  *; %FG,,O;,OO X{33)1[)@ghR]]F Pv *; >hmm1137UU_alm 17_TF!F8 ,@D@rc V^8dQhRRRR/#)rrr r Noner )r s"r rrs " " " "rch\V4pT'd \T4hR# \dR#i;i)aRaise ``ValueError`` if ``path`` is a denied Hermes read (see ``get_read_block_error``). Shared chokepoint for provider input-loading sites (e.g. image-gen local paths). Best-effort: unexpected internal errors no-op rather than break local-file loading; a real block still propagates. N)rrr8)rblockeds& r raise_if_read_blockedrs:&t,!! s " 11cV^8dQhRR/#)rr r r )r s"r rrs,,c,rc\4P4P\4P4R, 4PpT'd T^,#R# \ \ \3dR#i;i)zActive profile name from HERMES_HOME: ``~/.hermes`` -> ``"default"``, ``~/.hermes/profiles/X`` -> ``"X"``; ``"default"`` on any resolution failure.profilesdefault)rr-r7r!partsr>r?r8)rs r _resolve_active_profile_namersj!#++-99:K:M:U:U:WZd:dekk58+)+ \: .sAA##A=<A=u[Sandbox-mirror write blocked by soft guard: {target_path} sits under {mirror_root!r}, which is {body} Use the host-side tool for authoritative state (e.g. ``memory`` for memories), or address the host path directly. To bypass {bypass} with ``cross_profile=True``. (Defense-in-depth — not a security boundary; the terminal tool can still bypass.)c(V^8dQhRRRRRRRR/#)rtargetr mirror_root inner_pathr r r&r )r s"r rrs.cccDcccdcrc6R\V4R\V4RV/#)z1Common ``classify_*_mirror_target`` result shape. target_pathrr)r )rrrs&&&r _mirror_infors 3v; s;7GWa bbrc V^8dQhRRRR/#)rrr r Optional[dict]r )r s"r rrsFFFFrc .a\V4pVe VPMRo\V3Rl\S44R4pVfR#V^,\ S48d\ \ SV^,R!4MRp\V\ SRV^,!V4#)uClassify a write target as a sandbox-mirror of authoritative Hermes state: ``None`` for non-mirror paths, else ``target_path`` (resolved), ``mirror_root`` (the ``…/home/.hermes`` prefix) and ``inner_path`` (what the agent meant on the host).Nc3<"TF`wrVR8XgKV^,\S48gK'SV^,,R8XgK>SV^,,R8XgKUV^,xKb R#5i) sandboxesrlz.hermesN)rM)rwipartrs& r ry1classify_sandbox_mirror_target..so q.71 K  $%ECJ$6 ;@Q<6;Q V[\]`a\aVbfoVo Q.s A+A+A+A+A+rr )rArnext enumeraterMr rr)rr inner_idxinnerrs& @r classify_sandbox_mirror_targetrsT "F".FLLBE qi. q I 1:QU1KCeIMN+, -QSE eOi!m&< =u EErc(V^8dQhRRRRRRRR/#)rinforbodyr bypassr rfr )r s"r rrs.rr.rrSr]rrc tVfR#\P!R/VBRVPVR,R7RV/B#)z_Render ``_SANDBOX_MIRROR_WARNING`` for a classify_* result (``body`` may use ``{inner_path}``).Nrr)rrr )_SANDBOX_MIRROR_WARNINGr )rrrs&&&r _mirror_warningr s: | " ) ) qD qt{{dS_N`{7a qjp qqrc V^8dQhRRRR/#rr )r s"r rrs  S ] rc.\\V4RR4#)zModel-facing soft-guard warning when ``path`` lands in a sandbox mirror, else ``None``; the caller surfaces it as a tool-result error and ``cross_profile=True`` bypasses.ua per-task mirror created by a non-local terminal backend (docker/daytona/etc.). Writes here land on a copy that the host Hermes process never reads — the authoritative file is likely {inner_path!r} under the real HERMES_HOME.z8this guard after explicit user direction, retry the call)r rr@s&r get_sandbox_mirror_warningr s% &t, R C  rc$V^8dQhRRRRRR/#)rrr mirror_prefix str | Noner rr )r s"r rrs'OO3OzOUcOrc\V4V'd \V4MRr2VeVe\W#4'gR#\W#VPV4P 44#)ugClassify a write target as a container-side sandbox mirror. Inside the container the bind mount strips the ``sandboxes/`` prefix (the agent sees plain ``/root/.hermes/…``), so the caller supplies ``mirror_prefix`` once it knows file tools run in a docker sandbox. ``None`` without a prefix or outside it, else ``target_path``/``mirror_root``/``inner_path``.N)rAr;rr7as_posix)rrrmirrors&& r classify_container_mirror_targetrsQ %T*mOM,JaeF ~y/H/H (:(:6(B(K(K(M NNrc$V^8dQhRRRRRR/#)rrr rrr rfr )r s"r rrs"s:Q^rc.\\W4RR4#)z]Model-facing soft-guard warning when ``path`` lands in the container's mirror, else ``None``.uthe container's bind-mounted home — a per-task mirror that the host Hermes process never reads. The authoritative file is {inner_path!r} under the real HERMES_HOME.z$after explicit user direction, retry)r r)rrs&&r get_container_mirror_warningrs! (=  /  r)r)r|z.awsz.gnupgz.kubez.dockerz.azurez .config/ghz.config/gcloud)zstate.dbsessions mcp-tokenspairingvaultbrowser-profile>rn.envrc .env.test .env.local .env.staging.env.production.env.development))rz>is the Hermes MCP token directory and cannot be read directly.z7is a Hermes MCP token file and cannot be read directly.)rzjis the Hermes real-profile browser snapshot directory (copied cookies/logins) and cannot be read directly.zgis inside the Hermes real-profile browser snapshot (copied cookies/logins) and cannot be read directly.)rzwis the Hermes credential vault directory and cannot be read directly (secrets are filled server-side by browser_vault).zis inside the Hermes credential vault (encrypted secrets + local key) and cannot be read directly (browser_vault resolves them server-side).ru)2__conditional_annotations____doc__ __future__rrpathlibr contextlibrtypingrrrr!r)r(r;rArVrYrbrirrrrrrrrrrrr__annotations__rrrvrrrrrr rrr r rr)r#s@r r*sY# 5. 6 ZG02O^& X 0Dp9D$k>u>864 aW aE aO, [ 5v?[GGLL,-rww||GEU/V .Ab ",$Zc F$r Or