+ iHjM:a0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RI t ^RI t ^RI t ^RI t ^RI HtHtHt^RIHtHt^RIHtHtHt^RIHt^RIHtHtHtHtHtHtH t H!t!^RI"H#t#H$t$H%t%H&t&^RI't'^R I)H*t*^R I+H,t,]PZ!].4t/^ltWR?R@ltXRARBltYRCRDltZRERFlt[RGRHlt\]]RI3]^RJ33t_RKRLRMRLRNRO/t`RPtaRQRRltbRSRTltcRURVltdRWRXlteRYRZltfR[R\ltgR]R^lthR_R`ltiRtjRaRbltkRcRdltlReRfltmR]kRg]l/tnRh]=Ri&RjRkltoRlRmltpRnRoltqRpRqltrRrRslts]RtRul4ttRvRwltuRxRyltvRzR{ltwR|R}ltxRtyR~]=R&RRltzRRlt{RRlt|RRlt}RRlt~RRltR# ](dRt'EL!i;i)uShell-script hooks bridge: ``hooks:`` config → first-use consent per ``(event, command)`` → callbacks on the plugin hook manager, so every ``invoke_hook()`` site dispatches to the scripts. Wire: stdin JSON ``{hook_event_name, tool_name, tool_input, session_id, cwd, extra}``; optional stdout JSON ``{"decision"|"action": "block"|"modify", ...}`` / ``{"context": ...}`` via ``_parse_response``. Exit code 2 blocks a ``pre_tool_call`` even without JSON (Claude-Code / Cursor). Fail open unless ``fail_closed``.) annotationsN) ExitStackcontextmanagersuppress) dataclassfield)datetimetimezoneUTC)Path)AnyCallableDictIteratorListOptionalSetTuple) IS_WINDOWSkill_process_treesplit_command_linewindows_hide_flags)get_hermes_home)atomic_json_writei,zshell-hooks-allowlist.jsonzBlocked by shell hook. pre_tool_callpost_tool_calliz(set[tuple[str, str, Optional[str], str]] _registeredzset[tuple[str, str, str]]_launch_consentF _skip_loggedcV^8dQhRR/#returnstr)formats"6/home/ubuntu/.hermes/hermes-agent/agent/shell_hooks.py __annotate__r'Ds9939c`\\4P4P44#N)r#r expanduserresolver$r(r& _home_keyr-Ds"  ++-557 88r(c$V^8dQhRRRRRR/#)r!registryz set[tuple]lockzthreading.Lockr"Noner$)r%s"r&r'r'Hs&NNN>NdNr(c \4pT;_uu_4TPVUu0uFq3^,V8XgKVkK up4RRR4R#uupi +'giR#;i)zfDrop the current home's keys only (shared with outbound webhooks): profile A's reload must not drop B.N)r-difference_update)r/r0home_keyks&& r&_forget_home_registrationsr6HsJ{H ""x#Lx!Q48;KAAx#LM #L s AA A AA A& c(V^8dQhRRRRRRRR/#) r!er event Optional[str]commandr#r"boolr$)r%s"r&r'r'Os.nncn-n#n$nr(c\V\4;'d=VRJ;'gVPR4V8H;'dVPR4V8H#)Nr9r;) isinstancedictget)r8r9r;s&&&r&_entry_matchesrAOsK a  m mETM$L$LQUU7^u5L m mRSRWRWXaRbfmRmmr(cV^8dQhRR/#r r$)r%s"r&r'r'SsCCcCr(ct\P!\R7P4P RR4#)tz+00:00Z)rnowr isoformatreplacer$r(r& _utc_now_isorKSs' <<3  ) ) + 3 3Hc BBr(c V^8dQhRRRR/#)r!kwargsdict[str, Any]r"r$)r%s"r&r'r'WsN~r(c\\P!44p^RIHpRVP R4R\VP R4\4'dVP R4MRRVP R4;'gVP R4;'gRR TR V!4R VP4UUu/uFwr4V\9gKW4bK upp/# \dRpLi;iuuppi) zZCommon stdin/POST payload fields (shared with outbound webhooks); key order is wire order.)get_active_profile_name tool_name tool_inputargsN session_idparent_session_idcwdprofileextra) r#r rWOSErrorhermes_cli.profilesrQr@r>r?items_TOP_LEVEL_PAYLOAD_KEYS)rMrWrQr5vs& r&_payload_fieldsr_Ws$((*o<VZZ ,Jvzz&7I4,P,Pfjj(VZfjj.WW&**=P2QWWUW s*,6<<>V>41Q>U5U$!$>V  WsCC2C2 C/.C/cL]tRt^it$RtRtR]R&R]R&RRltR R ltR t R #) _ToolMatcherMixinzS``matcher`` regex handling shared by shell-hook specs and outbound webhook targets.z shell hookr:matcherOptional[re.Pattern]compiled_matchercV^8dQhRR/#r!r"r1r$)r%s"r&r'_ToolMatcherMixin.__annotate__ps - -t -r(c \VP\4'd*VPP4;'gRVnVP'd)\P !VP4VnR#R# \Pd?p\PRTPTPT4RTnRp?R#Rp?ii;i)Nu>%s matcher %r is invalid (%s) — treating as literal equality) r>rbr#striprecompilerderrorloggerwarning _MATCHER_KIND)selfexcs& r& __post_init___ToolMatcherMixin.__post_init__ps dllC ( (<<--/774DL <<< -(* 4<<(@% 88 -TVZVhVhjnjvjvx{)-%%  -s%BC3CCc V^8dQhRRRR/#)r!rRr:r"r<r$)r%s"r&r'rg}sFFmFFr(c VP'gR#VfR#VPfWP8H#VPPV4RJ#)TNF)rbrd fullmatch)rprRs&&r& matches_tool_ToolMatcherMixin.matches_tool}sL|||    ( , ,$$..y9EEr()rdrbN) __name__ __module__ __qualname____firstlineno____doc__ro__annotations__rrrw__static_attributes__r$r(r&rarais'] M ** -FFr(racx]tRt^t$RtR]R&R]R&RtR]R&]tR]R &R t R ]R &] !RR R 7t R]R&Rt R#) ShellHookSpeczAParsed and validated representation of a single ``hooks:`` entry.r#r9r;Nr:rbinttimeoutFr< fail_closed)defaultreprrcrdr$) ryrzr{r|r}r~rbDEFAULT_TIMEOUT_SECONDSrrrrdrr$r(r&rrs@K J L!G]!*GS*K-24e-L*Lr(r accept_hooks interactivec(V^8dQhRRRRRRRR/#)r!cfgOptional[dict[str, Any]]rr<rr"list[ShellHookSpec]r$)r%s"r&r'r's+33633&*37J3r(c l\V4wr4V'g.#^RIHpV!4\4rv\;_uu_4VUu.uFp\ Wx4\ 9gKVNK ppRRR4\W4\4r.p VF]p\WWR7'dV PV4K)\PRVPVP\44K_ \;_uu_4\!WgV 4uuRRR4#uupi +'giL;i +'giR#;i)abRegister every configured shell hook (idempotent); returns the newly wired specs. Skipped entries (unknown, malformed, not allowlisted, already registered) are logged only. ``interactive=True`` lets a hook that is not yet allowlisted ask at the terminal; only a foreground CLI command passes it. Every other caller (gateway startup and profile loads, cron and managed workers, tui_gateway, force-reload re-registration) never prompts: ``isatty()`` cannot tell a hidden console or ``NUL`` from a person, and a prompt there blocks the event loop until the liveness watchdog kills the gateway (#120356, #127822).get_plugin_managerNpromptushell hook for %s (%s) not allowlisted in %s — skipped. Use --accept-hooks / HERMES_ACCEPT_HOOKS=1 / hooks_auto_accept: true, or approve it at a CLI prompt for this profile.) _hook_specshermes_cli.pluginsrr-_registered_lock_keyr_resolve_effective_acceptallowlisted_pairs _consentedappendrmrnr9r;allowlist_path_wire) rrrspecs _completermanagerr4specacceptallowed consenteds &$$ r&register_from_configrs#3'E  5*,ikX  "'S%$4+?{+R%S /BDUDWGI dG @ @   T " NN/04 DLL.JZ \   W 2  T     s/DD D "D3 D" D D " D3 c V^8dQhRRRR/#)r!load_cfgzCallable[[], dict[str, Any]]r"r1r$)r%s"r&r'r's6l6l;6l6lr(c ^RIHp\;_uu_4V!4p\V4wr4Ve V'g RRR4R#\ 4wrV\ VR,4p\ 4p\PVU u0uFq.V O5kK up 4T\U U U u0uFwrqV8XgKW3kK up p p ,p\VR4p .pVFpV 'gVPVP3V9dVPV4K;WPVP3\9gK^\PWPVP34\P!RVPVP\#44K V!4p\$;_uu_4\'VW4V'd V'gYVRR3pV\9d6\PV4\P!RV'gR MR 4RRR4RRR4R#VUu0uFqVPVP3kK pp\P\Uu0uFpV^,V8XgKVV9gKVkK up4VUu0uFp\)W4kK pp\*Uu0uFpV^,V8XgKVV9gKVkK pp\*PV4VUu0uF pV^,kK upFPp VP,P/V .4Uu.uFp\1VR R4V9gKVNK upVP,V &KR RRR4RRR4XFwpp pp \P3R W4K R#uup iuup p p iuupiuupiuupiuupiuupiuupi +'giLh;i +'giLs;i) a;Bring this home's registered shell hooks in step with its config (``load_cfg()``) and consent, for a long-lived process (the gateway) that must behave as a new process would: hooks configured and consented since start register, hooks removed from config or revoked are unregistered. Consent is the allowlist, an opt-in in force (``hooks_auto_accept`` / ``HERMES_ACCEPT_HOOKS`` / this process's own ``--accept-hooks``), or a launch's ``--accept-hooks`` whose allowlist write failed (``accept_for_launch``). Never prompts or writes. An empty config (a loader that failed open), a malformed ``hooks:`` entry or an unreadable allowlist must never disarm a ``fail_closed`` guard, so each adds but never removes. Config and allowlist are read under the same lock as the apply, so the last sync to run always applies the newest state.rN approvalsFushell hook for %s (%s) not allowlisted in %s — skipped. Approve it at a CLI prompt for this profile, or use --accept-hooks / HERMES_ACCEPT_HOOKS=1 / hooks_auto_accept: true.rPremovalzNshell hooks: %s, so removed or revoked hooks stay registered until it is fixedzthe allowlist is unreadablez*a hooks: entry in config.yaml is malformedshell_hook_keyzDshell hook unregistered (removed from config or allowlist): %s -> %s)rr _sync_lockr_read_allowlist_approved_pairsr-rr3rr9r;rraddrmrnrrrrr_hooksr@getattrinfo)rrrrcomplete allowlistreadablerr4pairhomer9r;rwantedrr suspended configuredckeepr5stalecb_home_matchers& r&sync_from_configrs6 j%c* =   ./ !)K"89;))*Q+ d#JJ 5\I  (JJ !EF :;?::t||UcUeg %&   '8 ,%r95 L0 $$Y/NN$+QY,I(TV- BLQQ54TZZ>5JQ  - -/.v/QQqTU]M]qbckubuqq/.v w5; N, N?N, !N >N, N,N5N; N, N  N, $N 9N N N, #N" 5$N, N'2N'8N, N? N?N, , N< 7N?? O c$V^8dQhRRRRRR/#)r!rrrr<r"rr$)r%s"r&r'r's(VV$<VtV`sVr(c \V4wr#V'g.#\W4\4rTVUu.uFp\WdVRR7'gKVNK up#uupi)a First-use consent without registering anything, for a client whose turns run in a gateway that has no TTY: the prompt (or an opt-in) for each configured hook not yet allowlisted. The gateway registers from the same allowlist when the client opens its session. Returns the consented specs.Tr)rrrr)rrrrrrrs&$ r&record_consent_from_configrsQ#3'E  /BDUDWG" UUTjwt&T&TDDU UU Us A Ac V^8dQhRRRR/#)r!rrr"r1r$)r%s"r&r'r's K K3 K Kr(caa\VRR7pV'gR#\4\4uoo\;_uu_4\P VV3RlV44RRR4R# +'giR#;i)aTA launch's ``--accept-hooks`` on the gateway: record every configured hook in the allowlist, and keep the consent in memory when that write fails, so it still registers the hook at the next ``sync_from_config`` (main registered it in memory). Only an unsaved approval is held, so a later ``hermes hooks revoke`` of a saved one takes effect.TrNc3<"TF=pVPVP3S9gK"SVPVP3xK? R#5ir*r9r;).0rr4saveds& r& $accept_for_launch..s@KPU#'::t||"E ')9;OE8 KPUK K s !A(( A9 cV^8dQhRR/#rfr$)r%s"r&r'r'sDr(c RsR#)zThis process's own ``--accept-hooks`` (``hermes gateway run --accept-hooks``): an opt-in in force for its lifetime, as ``HERMES_ACCEPT_HOOKS`` would be, without exporting that variable to every tool subprocess.TN)_process_acceptr$r(r&accept_for_processrs Or(c V^8dQhRRRR/#)r!rrr"z*tuple[Optional[list[ShellHookSpec]], bool]r$)r%s"r&r'r's * *- *2\ *r(c^RIHp^RIHpV!4'g\ V\ 4'gR#V!R4'd\ PR4R#\VPR44#)u``(specs, complete)``: the configured hooks, or ``None`` when this process must run none (safe worker, safe mode, no config) — the one guard every registrar and the consent path share; ``complete`` is False when a configured entry was dropped as malformed.safe_worker_enabledenv_var_enabledHERMES_SAFE_MODEu6HERMES_SAFE_MODE=1 — shell-hook registration skippedhooks)NT) agent.safe_worker_policyrutilsrr>r?rmr _parse_hooksr@)rrrs& r&rrsX=%JsD$9$9)** LM ( ))r(c$V^8dQhRRRRRR/#)r!r4r#rrr"z#tuple[str, str, Optional[str], str]r$)r%s"r&r'r's">>3>m>0S>r(cHWPVPVP3#r*)r9rbr;)r4rs&&r&rrs jj$,, ==r(c(V^8dQhRRRRRRRR/#)r!rr r4r#rrr"r$)r%s"r&r'r' s*3#.AFYr(c .pVFp\W4pV\9dK\V4pWVnVPP VP .4PV4\PV4VPV4\PRVP VPVPVPVP4K V#)zRRegister ``specs`` not yet wired for this home; caller holds ``_registered_lock``.zIshell hook registered: %s -> %s (matcher=%s, timeout=%ds, fail_closed=%s))rr_make_callbackrr setdefaultr9rrrmrr;rbrr)rr4r registeredrkeycallbacks&&& r&rr sJ8" +  !$'"%!!$**b188B$ _JJ dllDLL$JZJZ \ r(c V^8dQhRRRR/#)r!rz list[Any]r"set[tuple[str, str]]r$)r%s"r&r'r'1snnyn-Anr(cVUu0uF{p\V\4'gK\VPR4\4'gKB\VPR4\4'gKiVR,VR,3kK} up#uupir)r>r?r@r#)rr8s& r&rr1sv09 n 1!T" ''1!%%.#'F 'KUVWV[V[\eVfhkKl 'QwZ9 &  nn nsB "B  "B 0B cV^8dQhRR/#)r!r"rr$)r%s"r&r'r'6s::/:r(c6\\4R,4#)r)rload_allowlistr$r(r&rr6s >+K8 99r(c ,V^8dQhRRRRRRRRRR/#) r!rrrr<rrrr"r$)r%s"r&r'r':s2  ] D ;O \` ei r(cVPVP3pWB9dR#V'g V'gR#\VPVPVR7'gR#VPV4R#)znAllowlisted, or approved now (opt-in, or a TTY prompt when ``prompt``; recorded); ``allowed`` caches one read.TFr)r9r;_prompt_and_recordr)rrrrrs&&&$ r&rr:sO JJ %D  f djj$,,V L L KK r(c V^8dQhRRRR/#)r!rrr"rr$)r%s"r&r'r'Hs QQ7Qr?_parse_hooks_blockr@)rs&r&iter_configured_hooksrHs(3=c43H3H cggg. /PbPr(cV^8dQhRR/#rfr$)r%s"r&r'r'Ms(($(r(cZ\\\4^RIHp\ V!44R#)uRe-register after a plugin force-reload cleared the manager's hooks; only this home's keys are cleared (profile A's reload never drops B), never re-prompts. ``PluginManager.discover_and_load(force=True)`` unloads via the ownership ledger and clears the manager's ``_hooks`` dict, which silently drops shell hooks that were registered from ``config.yaml`` at startup (they are config-owned, not plugin-owned, so the ledger cannot restore them). Clear the idempotence set and re-run ``register_from_config()`` so hooks are wired again (#60036 / PR #60267; tracking #64178 — salvaged from PR #64188). Only the idempotence keys for the *current* Hermes home are cleared — ``discover_and_load(force=True)`` only unloads the manager scoped to that one home, so clearing every home's keys would make a force-reload in profile A drop profile B's still-live registration from the ledger and duplicate it on B's next registration call (#92682 review).  load_configN)r6rrhermes_cli.configrrrs r&re_register_config_hooksrMs{,<=-'r(cV^8dQhRR/#rfr$)r%s"r&r'r'`sr(c\;_uu_4\P4RRR4\P4\P4RsR# +'giL<;i)z%Test-only: clear the idempotence set.NF)rrclearrrrr$r(r&reset_for_testsr`sA   O  s A A( c V^8dQhRRRR/#)r! hooks_cfgr r"rr$)r%s"r&r'r'ls&&#&*=&r(c&\V4^,#)zNNormalise ``hooks:`` into specs; malformed entries warn-and-skip, never raise.)r)rs&r&rrls  "1 %%r(c V^8dQhRRRR/#)r!rr r"z tuple[list[ShellHookSpec], bool]r$)r%s"r&r'r'qs""C"$D"r(c *^RIHpHpVf.R3#\V\4'g.R3#.pRpVP 4EFHwrVVR 9dKWQ9d\ PRV4K-WR9d}\P!\V4V^RR7pV'd\ PRWW^,4M/\ PR VR P\V444RpKVfK\V\4'g/\ PR V\V4P4RpK\!V4UU u.uFwr\#WXV 4NK p pp T;'dRV 9pVP%R V 44EKK W43#uup pi)z``(specs, complete)``: ``complete`` is False when an entry was dropped as malformed (a typo must not read as a deliberate removal); an absent or empty ``hooks:`` is complete.)SHELL_UNSUPPORTED_HOOKS VALID_HOOKSNTFzhook event %r is Python-plugin-only: shell hooks cannot return its directive, so this registration is refused rather than silently ignoredg333333?)ncutoffu;unknown hook event %r in hooks: config — did you mean %r?z2unknown hook event %r in hooks: config (valid: %s), z3hooks.%s must be a list of hook definitions; got %sc30"TF qfKVxK R#5ir*r$)rrs& r&r_parse_hooks..sAfdTTfs ) output_spilloutbound)rrrr>r?r\rmrndifflibget_close_matchesr#joinsortedlisttypery enumerate_parse_single_entryextend) rrrrr event_nameentries suggestionirawparseds & r&rrqsxH4x i & &5y!#EH(0 5 5   0 NNZ[e g   ( 223z?KST]`aJ\^huvjwxSU_aeajajkqr}k~aAH  ? '4(( NNPR\^bcj^k^t^t uH HQRYHZ[HZfa%jS9HZ[22F 2 AfAA/ 10 ?\sFc(V^8dQhRRRRRRRR/#) r!r9r#indexrrr r"zOptional[ShellHookSpec]r$)r%s"r&r'r's/'z'zs'z3'zS'z=T'zr(caaRVV3Rllp\V\4'gV!R\V4P4R#VP R4p\V\ 4'dVP 4'g V!R4R#VP R4pVe!\V\ 4'g V!R4RpVeS\9d V!RVS4Rp\VP R \44pV^8dV!R \4\pMV\8dV!R V\4\pVP R VP RR44p\V\4'g V!RV4RpV'd4S\9d)V!RRP\!\44S4Rp\#SVP 4WVVR7# \\3d(T!R TP R 4\4\pEL i;i)c$V^8dQhRRRRRR/#)r!msgr#rTr r"r1r$)r%s"r&r')_parse_single_entry..__annotate__s&BB#BcBdBr(cJ<\P!RV,SS.VO5!R#)z hooks.%s[%d]N)rmrn)rrTr9rs&*r&warn!_parse_single_entry..warns~+UEADAr(z/ must be a mapping with a 'command' key; got %sNr;z' is missing a non-empty 'command' fieldrbz).matcher must be a string regex; ignoringu.matcher=%r will be ignored at runtime — the matcher field is only honored for pre_tool_call / post_tool_call. The hook will fire on every %s event.rz3.timeout must be an int (got %r); using default %dsz'.timeout must be >=1; using default %dsz&.timeout=%ds exceeds max %ds; clampingr failClosedFzH.fail_closed must be a boolean (got %r); using default false (fail open)u.fail_closed=true will be ignored at runtime — fail_closed only applies to blocking-capable events (%s). The hook will fail open on %s like any other hook.r)r9r;rbrr)r>r?rryr@r#ri _TOOL_EVENTSrr TypeError ValueErrorMAX_TIMEOUT_SECONDSr<_BLOCKING_EVENTSrrr)r9rrr"r;rbrrsff& r&rrsBB c4  >S @R@RSggi G gs # #7==?? 67ggi G:gs#;#; 89uL8 VW^`e g*cggi)@AB{ 68OP) & & 5w@ST%''-u)EFK k4 ( ( WYde u$44 PQUQZQZ[abr[sQtv{ } ugmmowmx yy% z "* BCGGIDVXop)*sG 4HHzcommand not foundzcommand not executable.shbash.bash.pypythonzrcannot be run directly on Windows (there is no shebang support): start it with its interpreter, e.g. 'bash 'c V^8dQhRRRR/#)r!argvz list[str]r"r$)r%s"r&r'r's ! !y !Y !r(cZ\PPV^,4^,P4p\P V4pVe-\PP V^,4'gV#VR8Xd\P.VO#^RI H pV!4.VO#)z``argv`` with the interpreter prepended when element 0 is an existing script we can name an interpreter for; unchanged otherwise, including on POSIX, where the shebang already works.r.) _find_bash) ospathsplitextlower_WINDOWS_SCRIPT_INTERPRETERSr@isfilesys executabletools.environments.localr2)r0suffixkindr2s& r&_windows_script_argvr>sWW  d1g &q ) / / 1F ' + +F 3D |277>>$q'22  x&&&4 L 4  r(c$V^8dQhRRRRRR/#)r!rr stdin_jsonr#r"rNr$)r%s"r&r'r's!444C4N4r(c\aRRRRRRRRRR R R/oR V3R llp\\PPVP44pT'g T!R4#\ P!4p\'d R\4/MR^/p^RI H p^RI H p\'d \T4p\P !T3R\P"R\P"R\P"RRRRRRRRRT!T!4R7/TBp T P1YP2R 7wrSP=T P@T ;'gRT ;'gR\?\ P!4T, ^4R#7S# \ d$pT!R TP: RT 24uRp?#Rp?ii;i \$d{p\&F%wr\)YJ4'gKT!T 4uuRp?# \+TRR4^8XdT!T^,: R\, 24uRp?#T!\/T44uRp?#Rp?ii;i \4dp\7T 4\9\$4;_uu_4T P1^R!7RRR4M +'giM;i\)T\$4'gh\)T\P:4'gT!\/T44uRp?#SP=R\?\ P!4T, ^4R"7SuRp?#Rp?ii;i)$zrThe single subprocess site: run ``spec.command`` with ``stdin_json`` on stdin. Same result keys for every outcome. returncodeNstdoutrPstderr timed_outFelapsed_secondsgrlc V^8dQhRRRR/#)r!rlr#r"rNr$)r%s"r&r'_spawn..__annotate__scnr(c<VSR&S#)rlr$)rlresults&r&failed_spawn..failedsw r(zcommand z cannot be parsed: z empty command creationflags process_group)is_multiplex_active)build_subprocess_envstdintextTencodingutf-8errorsrJshellenv) scrub_secretswinerror )inputr)r)rErF)rBrCrDrF)!rr3r4r+r;r'time monotonicrragent.secret_scoperOr;rPr> subprocessPopenPIPE Exception _POPEN_ERRORSr>r_NOT_DIRECTLY_EXECUTABLEr# communicater BaseExceptionrrTimeoutExpiredrroundrB)rr@rKr0rqt0 popen_kwargsrOrPprocclsrrCrDrJs&& @r&_spawnrms*D(B"k[`bsux{BDHIFK!"''"4"4T\\"BC o&&  BOYjO5G5I#J_npq^rL7= :'-DoJOOoJOOo\f\k\ko%)o4;oDMoUZo$8GZG\$]oamo )) LL)Q MMT__V\\r&,,TVhmnrn|n|n~BDoDFGiHMI MU K 00CC5IJJK&  %HC###c{"& 3 D )S 0T!WKq)A(BCD Dc#h   $ i   Q  '! #y)) #z8899#c(# # eDNNBuild the closure that ``invoke_hook()`` will call per firing.c V^8dQhRRRR/#)r!rMr r"rr$)r%s"r&r'$_make_callback..__annotate__s\\C\$<\r(c <^RIHpV!4'dR#SP\9d)SP VP R44'gR#\ S\S\SPV444#)rNrR) rrr9r%rwr@_evaluate_resultrm_serialize_payload)rMrrs, r& _callback!_make_callback.._callbacks[@   :: %d.?.? ;@W.X.XfT3EdjjRX3Y&Z[[r(z shell_hook[:])r9r;ryr{)rrvsf r&rrs@\\5@ |1T\\NZ[2\\I/ r(c$V^8dQhRRRRRR/#)r!rrreasonr#r"rNr$)r%s"r&r'r'&s&ZZ]ZCZNZr(c.RRRRVP RV 2/#)actionblockmessagezhook z failed closed: )r;)rr{s&&r&_fail_closed_blockr&s$ gyE$,,?OPVx*X YYr(c$V^8dQhRRRRRR/#)r!rrrrNr"rr$)r%s"r&r'r'*s$88 8*88r(c VP\9pVP;'dTpVR,'d5\P RVPVP VR,4MBVR,'d4\P RVR,VPVP 4VR,'gVR,'d5V'd+\ YR,;'gRVP R24#R#VR ,P4pV'd4\PR VPVP VR\4VR ,\8XdV'd\VPVR ,4p\V\4'dVPR 4R8XdV#VR\;'g\ p\P#R\VPVP V4R RRV/#VR ,^8wd<\P RVR ,VPVP VR\4VR ,;'gRP4p\VPV4pVf.V'd&VR ,^8wd\ VRVR , R24#Vf.V'd&V'd\%V4'g \ VR4#V#)ufTurn a :func:`_spawn` diagnostic dict into the hook's contribution. Single place that encodes the failure semantics: * spawn error / timeout — fail open (log + ``None``) unless the spec is ``fail_closed`` on a blocking-capable event, in which case a canonical block shape is returned; * exit code 2 on a blocking-capable event — block, with the message taken from stdout block JSON, then stderr, then a default (Claude-Code / Cursor compatible); * other non-zero exits — warn, then parse stdout normally; a ``fail_closed`` hook blocks if no directive was produced; * non-JSON / unparseable stdout on a ``fail_closed`` blocking hook — block instead of silently contributing nothing. Shared by the live callback path (:func:`_make_callback`) and the CLI test helper (:func:`run_once`) so ``hermes hooks test`` reflects production behaviour exactly. rlz+shell hook failed (event=%s command=%s): %srEz6shell hook timed out after %.2fs (event=%s command=%s)rFztimed out after sNrDz+shell hook stderr (event=%s command=%s): %srBrCr}r~u;shell hook exited %d — blocking (event=%s command=%s): %srz5shell hook exited %d (event=%s command=%s); stderr=%srPz hook exited z with no directivez+unparseable stdout (expected a JSON object))r9r)rrmrnr;rrridebug_STDERR_MESSAGE_LIMITBLOCK_EXIT_CODE_parse_responser>r?r@_DEFAULT_BLOCK_MESSAGEr_is_json_object)rrblocking_eventrrDrrrCs&& r&rtrt*s\,ZZ#33N""55~KzzDdjjRVR^R^`abi`jk ;OQRSdQegkgqgqswss AzzQ{^^]h!$' (X(X8HVW6XYrnrr x[   F  BDJJPTP\P\^de{f{^|}/)n Qx[9 fd # # 8(<(GM//0JJ4J QSbdhdndnptp|p|F G'9g66!N DLL&I_J_B` bkR & & (F TZZ 0F ~+!L/Q*>! L< 11CD  ~+&9P9P"$(UVV Mr(c V^8dQhRRRR/#)r!rRr#r"r<r$)r%s"r&r'r'es#$r(c\\P!V4\4# \PdR#i;i)F)r>jsonloadsr?JSONDecodeError)rRs&r&rres5$**T*D11   s #&??c$V^8dQhRRRRRR/#)r!r9r#rMrNr"r$)r%s"r&r'r'ls&nncn>ncnr(cV\P!RV/\V4CR\R7#)zERender the stdin JSON payload; unserialisable values are stringified.hook_event_nameF) ensure_asciir)rdumpsr_r#)r9rMs&&r&ruruls' ::(%K?63JKZ_il mmr(c$V^8dQhRRRRRR/#)r!primaryr secondaryr"r#r$)r%s"r&r'r'qs&KKCKCKCKr(cfT;'gTp\V\4'd V'dV#\#)zKValidated string block message (primary wins), falling back to the default.)r>r#r)rrrs&& r&_block_messagerqs)   YCS#&&33J4JJr(c V^8dQhRRRR/#r!datarNr"rr$)r%s"r&r'r'|s~2Jr(c Z\FLwrr4VPV4R8XgKRRR\VPV4VPV44/u# \FRwprEVPV4R8XgK\VPV4\4'gKFRRRW,/u# VPR4R8XdcRR/pRFVpVPV4p\V\ 4'gK,VP 4'gKDVP 4Wg&KX V#R#)r~r}rmodifyrTapproveN)rrule_key)_PRE_TOOL_DIALECTSr@rr>r?r#ri) rverbrr_payload directivervalues & r&_parse_pre_tool_callr|s'9#y 88D>W $gy.'ARTXT\T\]fTg2hi i(: 2a 88D>X %*TXXg5F*M*Mh > > 2  xxY&%-y$9 *CHHSME%%%%++--!& + r(c V^8dQhRRRR/#rr$)r%s"r&r'r'sN/Gr(c\VPR4;'gVPR4;'gR4P4P4pVPR4;'gVPR4pVR9dA\ V\4'd+VP4'dRRRVP4/#R#)r}decisionrPrr{continueN>r~r)r#r@rir6r>)rr}rs& r&_parse_pre_verifyrs (#AAtxx ';AAr B H H J P P RFhhy!77TXXh%7G &&:gs+C+C *iAA r(c V^8dQhRRRR/#rr$)r%s"r&r'r'sZZZ,DZr(cVPR4p\V\4'dVP4'dRV/#R#)contextN)r@r>r#ri)rrs& r&_parse_contextrs7hhy!G#-gs#;#; Iw YUYYr( pre_verifyz?dict[str, Callable[[dict[str, Any]], Optional[dict[str, Any]]]]_RESPONSE_PARSERSc$V^8dQhRRRRRR/#)r!r9r#rCr"rr$)r%s"r&r'r's' b b3 b b0H br(cZT;'gRP4pV'gR#\P!V4p\ T\4'd!\PT\4!T4#R# \Pd"\P RYR,4R#i;i)zATranslate stdout JSON into a Hermes wire-shape dict, or ``None``.rPNz3shell hook stdout was not valid JSON (event=%s): %s:NN) rirrrrmrnr>r?rr@r)r9rCrs&& r&rrsll ! ! #F zz&!BLDRVAWAW   7 =a]aa   Le\`UabsA442B*)B*cV^8dQhRR/#)r!r"r r$)r%s"r&r'r's222r(c,\4\, #)z/Path to the per-user shell-hook allowlist file.)rALLOWLIST_FILENAMEr$r(r&rrs  1 11r(cV^8dQhRR/#)r!r"ztuple[dict[str, Any], bool]r$)r%s"r&r'r's4r(cr\P!\4PRR74p\T\4'gR./R3#\TPR4\4pT'g.TR&Y3# \d R./R3u#\P \ \3d R./R3u#i;i)z``(allowlist, readable)``: the parsed allowlist (an empty skeleton when absent or broken) and whether it could be trusted; a missing file is readable (nothing approved yet), an unreadable or malformed one is not.z utf-8-sigrSrTF) rrr read_textFileNotFoundErrorrrZUnicodeDecodeErrorr>r?r@r)rrs r&rrs(jj)33[3IJ c4 R %''#''+.5H K = 'R $&&  '+= >(R %''(s.A;;B6B6,B65B6cV^8dQhRR/#)r!r"rNr$)r%s"r&r'r's   r(c$\4^,#)z h_`a h hhs AAAcV^8dQhRR/#)r!r"zIterator[dict[str, Any]]r$)r%s"r&r'r's  ": r(c #4"\4pVPPRRR7\4;_uu_4p\fVP \ 4MVP \VPVPR,4RRR74p\P!VP4\P4VP\V4\4pVx\!V4RRR4R# +'giR#;i5i)zPSerialise allowlist read-modify-write across processes via a sibling flock file.T)parentsexist_okNz.lockza+rTr)rparentmkdirrfcntl enter_context_allowlist_write_lockopen with_suffixr<flockfilenoLOCK_EXr _flock_unlockrr)rstacklock_fhrs r&_locked_update_approvalsrs AHHNN4$N/  =    5 6))$q}}QXX=O/PRVah*ijG KK(%-- 8 NN=' 2 t s:DB>D: D D  Dc V^8dQhRRRR/#)r!rr r"r1r$)r%s"r&r'r's553545r(c\\4;_uu_4\P!VP 4\P 4RRR4R# +'giR#;ir*)rrZrrrLOCK_UN)rs&r&rrs5 '   GNN$emm4    s 4A A' c(V^8dQhRRRRRRRR/#)r!r9r#r;rr<r"r$)r%s"r&r'r's(""c"C"$"4"r(cV'd$\W4\PRW4R#\PP 4'gR#\ RV RV R24\R4P4P4pTR9d \Y4TR9# \\3d\ 4R#i;i) zKApprove an unseen ``(event, command)`` pair; True iff granted and recorded.zDshell hook auto-approved via --accept-hooks / env / config: %s -> %sTFuf ⚠ Hermes is about to register a shell hook that will run a command on your behalf. Event: z Command: zU Commands run with your full user credentials. Only approve commands you trust.zAllow this hook to run? [y/N]: >yyes) _record_approvalrmrr9rQisattyprintr[rir6EOFErrorKeyboardInterrupt)r9r;ranswers&&$ r&rrs( Z\ak 99      wogY7_ ` 89??AGGI( \ !! ' ( s%'B##CCc$V^8dQhRRRRRR/#)r!r9r#r;r"r1r$)r%s"r&r'r's&vvCv#v$vr(c &RVRVR\4R\V4/p\4;_uu_4pVPR.4Uu.uFp\ W@V4'dKVNK upV.,VR&RRR4R#uupi +'giR#;i)r9r; approved_atscript_mtime_at_approvalrN)rKscript_mtime_isorr@rA)r9r;entryrr8s&& r&rrs eY Pjl|~EmF GE ! # #t(,b(Ak(A1XYbiIjQQ(Akotnuu[ $ #k $ # #s#A?A:A:"A?:A?? B c V^8dQhRRRR/#)r!r;r#r"rr$)r%s"r&r'r' s//C/C/r(c J\4;_uu_4p\VPR.44pVPR.4Uu.uFp\VRV4'dKVNK upVR&V\VR,4, uuRRR4#uupi +'giR#;i)zRemove every allowlist entry for ``command``; returns the count. A gateway unregisters it at its next allowlist check (``sync_from_config``, about every 30 s) unless an opt-in approves every hook; other live processes keep it until restart.rN)rlenr@rA)r;rbeforer8s& r&revoker s " # #tTXXk2./(,b(Aj(A1XY[_ahIiQQ(Aj[D-.. $ #j $ # #s#0BB B #B B B" ztuple[str, ...]_SCRIPT_EXTENSIONSc V^8dQhRRRR/#)r!r;r#r"r$)r%s"r&r'r's\\#\#\r(c\V4;'gV.p\RT4R4;'g%\RT4R4;'g T^,# \dTu#i;i)zZFirst token with a script extension, else the first path-like token, else the first token.c3z"TF1qP4P\4'gK-VxK3 R#5ir*)r6endswithrrrs& r&r'_command_script_path..s$MUggi&8&89K&L!!Us*; ;Nc3f"TF'pRV9gVPR4'gK#VxK) R#5i)/~N) startswithrs& r&rrs#G1Q\\#5FQQs 1 1)rr'next)r;partss& r&_command_script_pathrsz"7+88y MUMt T [ [GGN [ [RWXYRZ\ sAA A'&A'c$V^8dQhRRRRRR/#)r!rrNaccept_hooks_argr<r"r$)r%s"r&r'r' s&uu>uTudur(c$^RIHpV'g\'gV!R4'dR#VPRR4p\ V\ 4'dV#\ V\ 4;'d&VP4P4\9#)ztAny truthy opt-in channel wins: explicit arg, this process's --accept-hooks, HERMES_ACCEPT_HOOKS, hooks_auto_accept.rHERMES_ACCEPT_HOOKSThooks_auto_acceptF) rrrr@r>r<r#rir6_TRUTHY)rrrcfg_vals&& r&rr sl&??o>S.T.Tgg)51G $//7tZ5M5t5tRYR_R_RaRgRgRimtRttr(c$V^8dQhRRRRRR/#)r!r9r#r;r"rr$)r%s"r&r'r',s'oosoSo5Mor(cdaa\VV3Rl\4PR.44R4#)z2Return the allowlist record for this pair, if any.c3R<"TFp\VSS4'gKVxK R#5ir*)rA)rr8r;r9s& r&r&allowlist_entry_for...s#gAq^TUW\^eEfAs' 'rN)rrr@rsffr&allowlist_entry_forr ,s' gN,00bAgim nnr(c V^8dQhRRRR/#)r!r;r#r"r:r$)r%s"r&r'r'1soocomor(cJ\V4pV'd=\PP\PP V44MRpTfR#\ P!T\R7P4PRR4# \ dR#i;i)zCISO-8601 mtime of the resolved script path, or ``None`` if missing.NrDrFrG) rr3r4getmtimer+rZr fromtimestampr rIrJ)r;r4mtimes& r&rr1s  (D>B  !3!3D!9:=4nh&<&1onrtrue>rTrRrUrV))r}rr{rT)rr{rrS) r*r,z.zshz.fishr-z.pywz.rbz.plz.luaz.jsz.mjsz.cjsz.ts)__conditional_annotations__r} __future__rr rloggingr3rjr_r9 threadingr\ contextlibrrr dataclassesrrrr r pathlibr typingr r rrrrrrhermes_cli._subprocess_compatrrrrr ImportErrorhermes_constantsrrr getLoggerryrmrr(rrr frozensetr)r%rrr]setrr~Lockrrrrrrr-r6rArKr_rarrrrrrrrrrrrrrrrrrrPermissionErrorrcr7rdr>rmrrrtrrurrrrrrrrrrrrrrrrrrrr rrr)rs@r&r.sv #    ::(,,LLLpo-#   8 $11o.//+;<=  $R9< 5=>>#"( ^^  .1U*2*-% '/9NnC$FF< M%M M3PU3-23>6lrVV[V K *>"n : Q (&& "J'zZ$%89OMe;fg !&vwxPP !4n  Z8vn Kp&Z Wfg{~JL]V^R^ b2 $ h   5 ".v /'KOK\uo ofS Es4J JJ