+ jHjRt^RIHt^RIt^RIt^RIt^RIt^RIt^RIt^RI H t ^RI H t H t Ht]P!]4t!RR]4t]P(!R4t]P(!R4t]P.'d+] !]P.4P0P34MR tR ]!0Rm4R ]!0Rm4/t]R ,]R&]!0Rm4]R&]P(!R4t]P(!R4t]!0Rm4t]!0Rm4t ]P(!R4t!]P(!R4t"Rt#RR/RRllt$RRlt%RRlt&RRlt'R R!lt(]P(!R"4t)]P(!R#4t*]P(!R$4t+]P(!R%4t,]P(!R&4t-]!0Rm4t.]!0Rm4t/R'R(0t0Rt1^t2]!R*4t3]!R+R,04t4]!0Rm4t5Rt6]P(!R-4t7]P(!R.4t8R/t9] ]:.]]:,3,t;]!0Rm4t0R20RmR3RR?0R40RmR50RmR60RmR7R 0R80RmR90RmR:0RmR;0RmR<0RmR=0Rm/t=R2RR8RR9R/t>R6^/t?]P(!R@4t@^tARtBRARBltCRCRDltDRERFltERGRHltF]1tGRItHRtIR)tJ^@tK!RJRK4tLRLRMltMRNROltNRPRQltORRRSltPRTRUltQRVRWltRRXRYltSRZR/R[R\lltTR]R^ltUR_R`ltVRaRbltWRcRdltXReRfltYRgRhltZRiRjlt[RkRllt\RmRnlt]RoRplt^RqRrlt_RsRtlt`RuRvltaRwRxltbRyRzltcR{R|ltdR}R~lteRRltfRR/RRlltgRRlthRRltiRR/RRlltjRR/RRlltkRR/RRlltlRRltmRRRR/RRlltnRRRR/RRlltoRRRR/RRlltpRRRlltqR#)u Gateway lifecycle guard for cron job creation. A cron job that restarts/stops the gateway from inside the gateway (``hermes gateway restart``, ``launchctl kickstart ai.hermes.gateway``, ``systemctl restart hermes-gateway``) kills the process, the supervisor revives it, auto-resume re-runs the turn: a SIGTERM-respawn loop. ``cron.jobs.create_job`` rejects such specs on every creation path. Patterns are command-shaped — anchored on concrete command identifiers — so they cannot fire on prose. Defence-in-depth layer. ) annotationsN)Path)CallableIteratorOptionalc]tRt^tRtRtR#)GatewayLifecycleBlockedzARaised when a cron job spec contains a gateway-lifecycle command.N)__name__ __module__ __qualname____firstlineno____doc____static_attributes__r 9/home/ubuntu/.hermes/hermes-agent/cron/lifecycle_guard.pyrrsKrra(?i)(?:(?%E%Ed%K LLzz|  _ _t$6$<$3_killer_targets_host_interpreter..s=uptklCf>fptTFc3*"TF qR9xK R#5i)-fN)rWz--fullr rPs& rrSrTs9^Y]TU?O:OY]rU--N-c3@<"TFp\VSSR7xK R#5i))r7r8N)rI)rQopr8r7s& rrSrTs"tkseg4RlZ_``ksstaskkillz/-imfiz#(?i)\s*['\"]?imagename\s+eq\s+(\S+):r get-processc3f"TF'qPR4Fp\V4xK K) R#5i),N)splitr4)rQrparts& rrSrTs+\u;;WZK[4$T**K[*s/1)rrrr)rr)z-namez -processnamer) anyr1_KILLER_VALUE_OPTIONSr-append enumerater)r>r4rer0groupr?) r2rKoperandspositiontokenoptionr filter_matchvaluesrG inline_valuer8r7s && @@r _killer_targets_host_interpreterrss 55uuDI$5##=upt=u###=upt=u:u#u11^^cc9^Y]9^ccc9^Y]9^6^  T"NE}A//-d33A ##C((& MHstkstsstststksttt z(cr3OH[[]))$/FA&E~"7">">~!xx(NPUV <$9,:L:LQ:O$P$P 4F$T?"'//#"6< <<>< < MM,,S[^_S_befjbkSkTQ,=Oqs u ] "5+;+;C+@+@hRSm[_kl`l[m[x[xy|[}[} MM% + 3\\33\3\3\\ \\rc$V^8dQhRRRRRR/#)rtokensrLkillerszfrozenset[str]r rr )r!s"rr"r"s"  I  SW rc\V4pVeV.M.pT\V4UUu.uF6wrE\V4P4P R4V9gK4VNK8 upp, pVFWp\W,4P4P R4pWq9gK9\ WpV^,R4'gKVR# R#uuppi)zWhether a tokenized segment runs one of *killers* against the host interpreter. The executable is read at the wrapper-peeled position first, then at the first killer token anywhere in the segment (`xargs kill`, Python argv lists).Nr%TF)_executed_command_indexri_executable_namer)r*rs)rurvindex candidatesirnrmr2s&& r_segment_names_host_interpreterr}s $F +E!-%2JYv%6z%6:J5:Q:W:W:Y:f:fgm:nry:y11%6zzJ 01779FFvN ??XXY\]F[\\  {s 1C C c V^8dQhRRRR/#rtextrr rr )r!s"rr"r"src\PRV4p\\P V44p\ V4FpRP V4p\PRV4pWT8wdW5P4.MV.FAp\V\4'dR#V'gK'\V\4'gK?R# K R#)aMBranch E entrypoint: a process killer aimed at the interpreter image hosting the gateway, or a name-derived PID feed into one (`pgrep python | xargs kill`, `kill $(pidof python3)`, `Get-Process python | Stop-Process`). Segment-tokenized, so quoted/spliced spellings and Python argv lists resolve the same way the shell resolves them.r<TF) _SHELL_LINE_CONTINUATIONsubr _KILL_VERB_RErA_iter_command_segmentsjoin_ARGV_LIST_PUNCTUATIONrcr} _NAME_KILLERS_NAME_ENUMERATORS)r normalizedkill_verb_presentsegmentjoinedstrippedrus& rcontains_host_interpreter_killrs *--c48J]11*=>)*5'")--c6:7?6H!12wiWF.v}EE  %DVM^%_%_ X 6 rz \\\r?\n[ \t]*z[\[\],]+z(?i)hermes\s+(?:-\S++(?:\s++(?!-\S)\S++)?\s++)*(?:--profile=([^\s]+)|(?:-p|--profile)\s+([^\s]+))(?:\s++-\S++(?:\s++(?!-\S)\S++)?)*\s+gateway\s+(?:restart|stop)zV(?i)\blaunchctl\s+(?:kickstart|unload|load|stop|restart|bootout|kill|disable|remove)\bz(?i)\bhermes[.\-]?gateway\b-c --commandi;&|()zMobile Documents CloudStoragez ^\.[A-Za-z]zB\|\s*&?\s*(?:sudo\s+)?(?:sh|bash|dash|ksh|zsh|xargs|eval|source)\bisudodoasenvniceionicestdbuftimeoutpkexecsurunusersetpriv systemd-runnsenterunshare-Cz --adjustmentz^[A-Za-z_][A-Za-z0-9_]*=cV^8dQhRR/#)rr Optional[str]r )r!s"rr"r"ss""}"rc^RIHpV!4#)z[Profile running the guard (``hermes_cli.profiles.current_profile_name``); ``None`` if none.current_profile_name)hermes_cli.profilesrrs r_current_profile_namerss8  !!rc V^8dQhRRRR/#)rnamedrr rr )r!s"rr"r"zsTTSTTTrc\4p\V4;'d>VP4P4VP4P48H#)zTrue when *named* is the profile executing the guard. Without a profile identity self-targeting cannot be proven, so nothing is blocked (sibling restarts stay allowed).)rrr(casefold)rcurrents& r_named_profile_is_currentrzsA$%G = S SU[[]3359Q9Q9SSSrc V^8dQhRRRR/#)rnormalized_textrr rr )r!s"rr"r"s34rc\\PV44;'d\\PV44#)uHOrder-independent companion to Branch B — see the verbs regex comment.)r_LAUNCHCTL_LIFECYCLE_VERBS_RErA_HERMES_GATEWAY_LABEL_RE)rs&r%_contains_launchctl_gateway_lifecyclers; -44_E F  4 ''8Lrc V^8dQhRRRR/#rr )r!s"rr"r"s?k?kS?kT?krcV'gR#^RIHpV!V4p\PRV4p\P V4'dR#\ P V4pV'dcVP^4;'gVP^4pV'd1\VP4PR44'dR#\V4FvpRPV4pV'd\P V4'dR#\PRV4pWv8wgKX\P V4'gKuR# \V4;'g \V4#)uReturn True if *text* contains a gateway lifecycle command pattern. Passes, in order: raw-text regex (the only pass that fires on inputs shlex cannot tokenize, e.g. Python source); profile-flag form; the same regex on each shell-tokenized segment with quotes/ escapes resolved (closes splice bypasses like ``kick"start"`` / ``kick\start``); order-independent launchctl pass. Single choke point for every recursion level of ``_contains_unsafe_gateway_action``. That second pass exists because a real shell resolves quote-splicing (``kick"start"``) and backslash-escaping (``kick\start``) into one literal word — ``kickstart`` — before the command ever runs. The raw text still has the quote or backslash sitting between the verb's two halves, so the first pass alone lets a spliced verb reach ``launchctl``/``systemctl`` untouched while still executing as the blocked lifecycle command (#80269, reported against #80260's bootout parity fix). Tokenizing closes that gap while keeping the same gateway-label anchoring (``_GATEWAY_LIFECYCLE_PATTERN`` still requires a ``hermes``/``gateway`` token) — this function is the single choke point ``_contains_unsafe_gateway_action`` calls at every recursion level, so referenced-script and ``sh -c`` payload scanning inherit the fix automatically. Fstrip_inert_heredoc_bodiesr<Tr$)tools.shell_heredocrrr_GATEWAY_LIFECYCLE_PATTERNrA_PROFILE_FLAG_LIFECYCLE_PATTERNrkrr(rrrrr)rrr profile_matchrrrrs& r"contains_gateway_lifecycle_commandrs& ? %d +D)--c48J!((44 4:::FM##A&@@-*=*=a*@ .u{{}/B/B5/IJJ **5'" 077??)--c6:  "<"C"CH"M"M 6 1 < j j@^_i@jjri@cN]tRtRtRtR tRRltRRltRRltR R lt R t R #) _LifecycleScanBudgetia Shared work budget for one complete referenced-script walk. ``refusal`` records why the walk failed closed for a reason other than a lifecycle command (budget, size, device, live SQLite, cloud placeholder) so the caller can tell the model the real reason (#113944).cV^8dQhRR/#)rr Noner )r!s"rr"!_LifecycleScanBudget.__annotate__s++$+rc l\Vn\Vn\Vn\ VnRVnR#N) _MAX_LIFECYCLE_SCAN_BYTESbytes_remaining_MAX_LIFECYCLE_SCAN_LINESlines_remaining_MAX_LIFECYCLE_SCAN_PATHSpaths_remaining _MAX_LIFECYCLE_SCAN_REMOTE_READSremote_reads_remainingrefusalselfs&r__init___LifecycleScanBudget.__init__s)888&F#&* rc V^8dQhRRRR/#rr )r!s"rr"rsrc \V4VP8dR#\VPRRR74pW P8dR#VPR4^,pW0P8dR#\ RVP R44^R7pV\8dR#V;PV,unV;PV,unR#) z>Charge *text* before tokenization; False when it does not fit.Futf-8replaceerrors c38"TFp\V4xK R#5ir)r1)rQlines& rrS3_LifecycleScanBudget.charge_text..s>-=Ts4yy-=s)defaultT)r1rencodecountrmaxrc_MAX_LIFECYCLE_SCAN_LINE_BYTES)rrencodedlineslongests&& r charge_text _LifecycleScanBudget.charge_texts t9t++ +dkk')k<= )) ) 4 1$ '' '>TZZ-=>J 3 3 ' %rcV^8dQhRR/#rr rr )r!s"rr"rsTrc ^VP^8:dR#V;P^,unR#)z?Charge one unique referenced path before any local/remote read.FT)rrs&r charge_path _LifecycleScanBudget.charge_paths'   1 $ !rcV^8dQhRR/#rr )r!s"rr"r sDrc ^VP^8:dR#V;P^,unR#)z:Charge one remote-backend read (a network roundtrip each).FT)rrs&rcharge_remote_read'_LifecycleScanBudget.charge_remote_read s'  & &! + ##q(#r)rrrrrN) r r r r r __slots__rrrrrr rrrrs(VI+(rrc V^8dQhRRRR/#)r max_bytes Optional[int]r intr )r!s"rr"r"sEE-ECErc \Vf\#\\\^\V444#)zPer-read byte cap: never above the per-file cap, never negative. One definition so local and remote reads cannot diverge. See #76762, #77703. )_MAX_REFERENCED_SCRIPT_BYTESminrrrs&r_capped_read_limitrs) ++ +SC N-C DDrc V^8dQhRRRR/#rr )r!s"rr"r"sCDrcZ\4PV4# \dR#i;i)usWhether *text* may safely enter an optional tokenizer pass (``tools/terminal_tool.py`` gates its launchctl pre-scan on this). A FRESH budget, independent of the full guard's walk: the pre-scan may pass while the walk later exhausts, still fail-closed — only the friendlier launchctl diagnostic is lost. ``False`` is not a verdict: callers must still run the full guard.F)rr Exception)rs&r!lifecycle_scan_root_within_budgetrs- #%11$77 s  **c(V^8dQhRRRRRRRR/#) rbudgetrwhatrdepthrr rr )r!s"rr"r")s)2#cdrcN\PRW4RV RV R2VnR#)ulifecycle guard scan budget exhausted (%s at depth %d); failing closed — see _MAX_LIFECYCLE_SCAN_* in cron/lifecycle_guard.pyzthe scan budget was exhausted (z at depth )Tloggerwarningr)rrrs&&&r_budget_exhaustedr)s2 NN R  7tfJugQOFN rc V^8dQhRRRR/#)rpathrr rr )r!s"rr"r"3s w wT wc wrc^RIHpV!V4'dRV R2#\P!V4p\P !TP 4'gRT R2#RT R\ R2# \d RT R2u#i;i)zName why an *executed* script failed closed without being scanned (live SQLite, device, oversized). Message-only: the fail-closed verdict itself came from the bounded reader.)has_live_connection`z3` is a SQLite database open in this gateway processz` could not be readz` is not a regular filez` is larger than the scan cap ($ bytes) or the remaining walk budget)hermes_cli.sqlite_safe_readr osstatOSErrorS_ISREGst_moder)r r metadatas& r_unreadable_reasonr3s@4  4&KLL-774= <<(( ) )4&/00 tf34P3QQu vv -4&+,,-sA++A?>A?c(V^8dQhRRRRRRRR/#) rrrr rreasonrr rr )r!s"rr"r"Cs*34QUrc>\PRW4W nR#)zDlifecycle guard cannot scan referenced script %s: %s; failing closedTr)rr rs&&&r_refuse_unreadablerCs NNY[_hN rc V^8dQhRRRR/#)rrrr rLr )r!s"rr"r"Kssyrc.p.pR;p;rEVFpV'dRpMsVR8XdRpMiVR8XdV'g V'*pMRVR8XdV'g V'*pM;VR8Xd5V'g-V'g%VPRPV44.pKVPV4K V'd!VPRPV44V#)z]Split on newlines outside quotes (a quoted newline is data, not a separator); honors escapes.F\T'"rr)rhr)rrr in_single in_doubleescapechs& r_split_logical_linesr#KsEG%**I*  F 4ZF 3Yy% I 3Yy% I 4Z ) LL) *G r RWWW%& Lrc V^8dQhRRRR/#)rrrr rLr )r!s"rr"r"ds rcf\P!VRRR7pRVnRVn\V4#)zSPOSIX-tokenize one shell line, honoring quotes and `#` comments; raises ValueError.Tr)posixpunctuation_chars#)shlexwhitespace_split commenterslist)rlexers& r _shlex_tokensr.ds. KKDG DE!EE ;r keep_controlsc$V^8dQhRRRRRR/#)rrurLr/rr Iterator[list[str]]r )r!s"rr"r"ls"IJ]rc#".pVFMpV'd2\V4\8:dV'dVx.pV'dV.xK<VPV4KO V'dVxR#R#5i)zYield non-empty runs of *tokens* between control-operator tokens; with *keep_controls* each control token is also yielded as its own segment so the line can be rebuilt in order.N)set_CONTROL_CHARSrh)rur/rrns&$ r_split_segmentsr5lsYG SZ>1 g u s+A( A(#A( A(c V^8dQhRRRR/#)rcommandrr r1r )r!s"rr"r"}s + +C +,? +rc#F"\VPRR44F"p\V4p\ T4RjxL K$ R# \dLTP 4F3p\ \T44RjxL K# \dK1i;i K}i;iLc5i)zYield shell-tokenized command segments per logical line; a line shlex rejects (unbalanced quotes) falls back to per-physical-line tokenization.z\ rN)r#rr. ValueError splitlinesr5)r7rru physical_lines& rrr}s%W__VR%@A "4(F#6***B !%!2 .}]/KLLL!"3    +saB! AB!B B!B%B<A? =BB B BB BB!BB!c V^8dQhRRRR/#)rrnrr r )r!s"rr"r"s%%C%C%rc@\V4P;'gT#)zCommand name of an executable token. ``Path(token).name`` is "" for ``.``, ``..`` and ``/``; the POSIX dot-source builtin is spelled ``.``, so fall back to the raw token or ``. ./helper.sh`` would escape the sourced-script scan.)rr2)rns&rryrys ;   $ $u$rc$V^8dQhRRRRRR/#)rrrLrzrr r )r!s"rr"r"s! ##rc\\4EF7pV\V48dVu#\W,4pV\9dVu#\ P V\44pV^, pV\V48diW,pVR8Xd V^, pMOWT9d V^, pK:VPR4'g\PV4'd V^, pKw\\P V^44F=pV\V48gKW,PR4'dK4V^, pK? EK: V#)uIndex of the command a wrapper chain actually executes. Unchanged if not a wrapper; may be ``len(segment)`` when a wrapper has no operand — callers must bounds-check.rXrY) range_MAX_PREFIX_PEELSr1ry_TRANSPARENT_COMMAND_PREFIXES!_TRANSPARENT_PREFIX_VALUE_OPTIONSget frozensetr-_ENV_ASSIGNMENTr0_TRANSPARENT_PREFIX_OPERANDS)rrzrGr2 value_optionsrns&& r_peel_transparent_prefixesrIs$ % CL L/ 4 4L9==dIKP   c'l"NE} % $$(=(=e(D(D  377a@AAs7|#GN,E,Ec,J,J B+&0 Lrc V^8dQhRRRR/#rrrLr rr )r!s"rr"r"sbb)b brc:\R\V44R4#)z?Return the executable token index after simple env assignments.c3d"TF&wr\PV4'dK"VxK( R#5ir)rFr0)rQr|rns& rrS'_command_token_index..s$Z#5xq_=R=RSX=Y#5s0 0N)nextri)rs&r_command_token_indexrPs Z9W#5Z\` aarc V^8dQhRRRR/#rKr )r!s"rr"r"s33Y3=3rcb\V4pVfR#\W4pV\V48dV#R#)zWIndex of the command a segment actually executes (env assignments and wrappers peeled).N)rPrIr1)rrzs& rrxrxs4  )E } &w 6ECL(52d2rc V^8dQhRRRR/#rr7rr rr )r!s"rr"r"sstrc\V4F`p\V4pVfK\W,4R8XgK,W^,RpV'gKAV^,P4R9gK_R# R#)uDetect an executed ``launchctl submit``/``bootstrap``, not quoted text. Label-independent by design: a NEW job's label is attacker-chosen, so a neutral name defeats any label-anchored regex. Both verbs register a persistent launchd job — never safe in the gateway. See #62891. N launchctlTF>submit bootstrap)rrxryr))r7rrz argumentss& r!contains_launchctl_submit_commandrZsb*'2'0  !1'.!A[!P ,IyYq\//15LL 3 rc V^8dQhRRRR/#)rrrr r )r!s"rr"r"s%5%5C%5C%5rc0.pRpVP4;'gV.EF4p\PV4'dVPV4K2\ V4p.p\ TRR7Fp\T4pTe\Yg,4P\9d}Yg^,Rp\;QJdRT4F 'gK RM RM !RT44'g8RpTPTRT^,4TPRT44KTPT4K TPRPT44EK7 V'dRPV4#T# \ dTPT4EKti;i) aReplace data-sink executables' arguments with a neutral placeholder. The regex cannot tell an EXECUTED lifecycle command from the same characters as *data* (a grep pattern, a SQL literal): every argument of a ``_DATA_SINK_EXECUTABLES`` segment becomes ``arg`` and a match that survives is a real command. Strictly fail-closed: masking is skipped when the line pipes into a shell/interpreter, any argument carries an execution marker, or the line cannot be tokenized. Masking can only ALLOW what the plain regex would block, never block more. FT)r/Nc3a"TFdo\PS4;'gC\;QJd#V3Rl\4F 'gK RM RM!V3Rl\44xKf R#5i)c3,<"TF qS9xK R#5irr )rQmarkerarguments& rrS6_mask_data_sink_arguments...sU.sW%.*//9VVsU%>BX%X#AIK0 s%.sss%. #GNN7;UQY#78NN"<)"<< NN7 #C '*+3,4$+499Y 44)    T "  s E44FFc V^8dQhRRRR/#rr )r!s"rr"r"sUUcUdUrc|\V4'gR#\PRV4p\\V44#)zLifecycle scan exempting matches inside data arguments: cheap regex first (no-match pays nothing), then re-scan with data-sink arguments masked; only a surviving match blocks.Fr<)rrrrm)rrs& r+_lifecycle_command_scan_with_data_exemptionrps5 .d 3 3)--c48J -.G .S TTrc V^8dQhRRRR/#rTr )r!s"rr"r"sCDrc>\V4;'g \V4#)zCPure-string direct scans: lifecycle regex (data-exempted) + submit.)rprZ)r7s&r_direct_lifecycle_scanrss# 4G< 6 6 ,W 5rc V^8dQhRRRR/#)rr rr r )r!s"rr"r" s4DrcZVPRR7# \\3dTu#i;i)u``path.resolve(strict=False)``, falling back to *path* on OSError (unreadable/long) or ValueError (embedded NUL from decoded binary tokenized as a path) — never crash the guard.F)strict)resolverr9r s&r_resolve_lenientry s1||5|)) Z  s **c V^8dQhRRRR/#rr rr rr )r!s"rr"r"s  T d rcaVPo\;QJd(V3Rl\S44F 'gK R# R#!V3Rl\S444#)a True for paths inside a macOS FileProvider-backed subtree. ``O_NONBLOCK`` does not make regular-file reads non-blocking, so opening an evicted placeholder can wait indefinitely for hydration before any command timeout starts: identify the boundary from the path alone.c3<"TF5wrV'gKSV^, ,R8H;'d V\9xK7 R#5i)LibraryN)_CLOUD_PLACEHOLDER_MARKERS)rQrzrdpartss& rrS-_is_cloud_placeholder_path..s?+KE  MeaiI%LL$2L*LL+s AAATF)rrfri)r rs&@r_is_cloud_placeholder_pathrsS JJE 3$U+3333$U+ rc V^8dQhRRRR/#r{r )r!s"rr"r"!sbbb$brcP\V4;'g\\V44#)zWLexical OR resolved cloud check: covers direct cloud paths and local symlinks into one.)rryrxs&r_on_cloud_pathr!s" %d + a a/IJZ[_J`/aarc V^8dQhRRRR/#)r candidaterr Optional[Path]r )r!s"rr"r"&scnrcV'dRV9dR#\V4P4# \\\3dR#i;i)uSanitize a tokenized path candidate at the ingestion boundary. Tokens from shlex-splitting arbitrary (possibly binary-decoded) text can carry NUL or junk that each downstream ``Path`` op rejects differently (ValueError, RuntimeError when HOME is unset under launchd, OSError); reject once here. ``None`` = not a real path, nothing to scan. Every OS-facing ``Path`` operation downstream (``expanduser``, ``os.open``, ``resolve``) raises a *different* exception for the same junk (``ValueError: embedded null byte``, ``RuntimeError: Could not determine home directory`` when HOME is unset under launchd, OSError for over-long paths). Rejecting here — once, before any OS call — is the whole-class fix; catching per-syscall was the whack-a-mole that produced #76762, #77703, #77780, and #78256. N)r expanduserr9 RuntimeErrorr)rs&r_expand_candidate_pathr&sB )+I))++  g .s,AAc$V^8dQhRRRRRR/#)rrrcwdrr Iterator[Path]r )r!s"rr"r":s!  C m  rc#"\V4pVfR#VP4'g1\T;'g\P!44V, pVxR# \dR#i;i5i)zPYield *candidate* anchored on *cwd* (or the process cwd) when it is a real path.N)r is_absoluterrr)rrr s&& r_resolved_or_nothingr:sb !) ,D |      ))txxz*T1D J   s-'A2 A !A A2 A/+A2.A//A2c V^8dQhRRRR/#)r script_pathrr rr )r!s"rr"r"Hscnrc^RIHp\V4pVfR#VP4'dV#V!4R, V, # \\ 3dR#i;i)zResolve a cron ``script`` value the way ``cron.scheduler`` does (relative paths live under ``/scripts/``) so the guard scans the file that will actually run.)get_hermes_homeNscripts)hermes_constantsrrrrr)rrraws& r_resolve_script_pathrHs\1  -C {   9,s22 ' "sAAAc V^8dQhRRRR/#)rrrr rr )r!s"rr"r"Zs3=rc\V4pVe,VP4'd\VP4#R# \dR#i;i)zHReturn the directory *script_path* resolves to, handling relative names.N)rrrparentr)rr s& r_resolve_script_directoryrZsP #K0   0 0 2 2t{{# #     s$>> A  A c(V^8dQhRRRRRRRR/#) rrrLrBrrorr Iterator[str]r )r!s"rr"r"gs(&&&3&& &rc#("VR,p\V^,\V44FdpW,pWR8Xd+V^,\V48dW^,,xK;VPV4'gKTV\V4RxKf R#5i)zIYield values given to *option*, in both ``--opt v`` and ``--opt=v`` form.=N)r@r1r-)rrBror3rmrns&&& r_iter_option_valuesrgsr c\F%!)S\2! ?x!|c'l:Q,' '   f % %F % % 3s A5B<Bc(V^8dQhRRRRRRRR/#) rrrLrzrrrr rr )r!s"rr"r"rs($9$9I$9c$9 $9.$9rc#"V\V48dR#W,p\V4pVR9d;\V4V^,8d"\W^,,V4RjxL R#V\9dW^,Rp^pV\V48d_WV,pVR8Xd V^, pMEV\9dM9V\ 9d V^, pKKVP R4'd V^, pKmV\V48d,WV,\9d\WV,V4RjxL R#VPR4'd6RV9gVPR4'd\W24RjxL R#R#R#ELLWL5i)z8Yield the scripts the token at *index* executes, if any.NrXrY/>.source)z.shz.bashz.zsh) r1ryr_SHELL_EXECUTABLES_SHELL_COMMAND_FLAGS_SHELL_OPTIONS_WITH_VALUESr-r(r+)rrzr executableexecutable_namerY arg_indexr`s&&& r_references_atrrs\ G J&z2O/) w<%!) #+GAI,>D D D,,AIK(  #i.( +H4Q //55Q ""3''Q   s9~ %)*>FZ*Z+I,@#F F F#"3z7J7JKc7d7d' 8888e5 E* G 9sDA F"E:#A?F#AF%E=&F,F/E?0 F=F?Frc$V^8dQhRRRRRR/#)rr7rrrr rr )r!s"rr"r"s" < 2RTVWF*76B B BX'0 =,W^ **rrc$V^8dQhRRRRRR/#rr rrrr tuple[Optional[str], bool]r )r!s"rr"r"s$ +rc^RIHpHpV!VRR7;_uu_4\WR7uuRRR4# +'giR#;i TdRu#\\ 3dRu#i;i)abRead a referenced script without racing SQLite connection lifecycle. The registry check must cover the complete ``open``/``read``/``close`` sequence. A separate ``has_live_connection`` check would leave a race in which another thread opens SQLite after the check but before this function closes its descriptor, cancelling that connection's POSIX locks. )LiveConnectionErroroffline_file_accesszread referenced script)rrNNTNF)rrr _read_referenced_script_unlockedrr9)r rrrs&$ r_read_referenced_scriptrsZU ,D E E3DNF E E E  Z s6A 3 A A AA A'A'!A'&A'c$V^8dQhRRRRRR/#rr )r!s"rr"r"s$?9?9 ?9+?9?9rc\V4p\V4'dR #\P\ \R^4,p\P !W4p\P!T4p\P!TP4'g>R\P!TP4'*3\P!T4#\P!T\4p\!T4'dR \P!T4#TP"T8dR \P!T4#\%T4T8:dA\P!YB^,\%T4, 4pT'gM Yg, pKP\P!T4\!T4'dR #\%T4T8dR #RT9dTP'RR4pTP)RRR7R3# \ \3dR u#i;i \ dR u\P!T4#i;i \P!T4i;i) uReturn ``(text, unsafe)`` using bounded, regular-file-only reads. Shared choke point for every local script read, so the cloud-placeholder refusal lives here: a FileProvider path is never opened — not even to check hydration — because an evicted placeholder's ``open()`` can hang preflight. Lexical check: direct paths; resolved: symlinks. ``max_bytes`` lowers the per-file cap to what the calling walk can still afford. See #88052. N O_NONBLOCKFrrrrrr)rrrO_RDONLYgetattropenrr9fstatrrrS_ISDIRcloseread_BINARY_SNIFF_BYTESrst_sizer1rdecode)r r byte_limitflags descriptorrrchunks&$ rrrs$I.Jd KK'"lA6 6EWWT) 88J'||H,,--T\\(*:*:;;;, !wwz#67 T " "    j ( $i:%GGJQT(BCE MD &  4y:$||GS) ;;wy; 15 88[ Z B   s\G=A"H-HHAHH? HH?=HH H<#H?;H<<H??Ic$V^8dQhRRRRRR/#)rrrrrr rr )r!s"rr"r"s$ '4rcV'dRV9dR#\V4p\V4V8dR#\VPRRR74V8dR#VR3#)aApply the local-read contract to text from an untrusted ``read_remote_script`` callback: NUL means binary (nothing to scan, checked first); oversized fails closed. Size compares re-encoded *bytes* (matching the ``head -c`` wire bound): a >1 MiB multibyte file truncated at the byte cap decodes to fewer chars, and a char count would scan instead of failing. The recursion boundary must not trust its callbacks: any backend (SSH, Modal, Daytona, or a future one) can hand back raw binary bytes decoded as text, or arbitrarily large output. Enforced here rather than inside each callback so the guarantee holds for every callback, not just the ones we hardened. See #76762, #77703. rFrrrrr)rr1r)rrrs&$ r_sanitize_remote_script_textrsY 6T>#I.J 4y: 4;;wy; 12Z? ;rc V^8dQhRRRR/#)rrrr ztuple[str, Optional[str]]r )r!s"rr"r"6s # #3 #3L #rc\V4pVfR#\V4wr#V'dR\V43#T;'gRR3#)z``(text, refusal)``: read a cron script with the bounded scanner. Non-regular/oversized/live SQLite inputs fail closed with a NAMED *refusal* (never a lifecycle-shaped verdict); missing or unreadable paths stay empty so scheduler validation reports them.Nr)rN)rrr)rresolved script_textunsafes& r_read_script_for_scanningr6sM$K0H1(;K %h///   "d ""rread_remote_scriptexecutedTc8V^8dQhRRRRRRRRR R R R R RRR/#)rr7rrrrrvisitedz set[Path]rrrOptional[_ReadRemoteScriptFn]rrr r )r!s"rr"r"EsXXX X'X03X>GXQeX5XHLX Xrc aaaaSPV4'gV'd\SRS4#R#\V4'dR#S\8dV#RVVVV3Rllp^RIHpV!V4p \ V 4Fp V!WV4'gKR# \WR7U u.uFqV3NK p p W8wd%T \WR7U u.uFqR3NK up , p V EFwr\V 4'dV'd\SV RV R 24u#K4\V 4pVS9dKHSP4'gV'd\SR S4u#R#SPV4\V SPR 7wppV'd#V'd\SV \V 44u#KVfSeSP!4'gV'd\SR S4u#R#\#S!\%V 44SPR 7wppV'd&V'd\SV RV R \& R24u#EK[V'gEKfT!T\)\%V44;'gTV4'gEKR# R#uup iuup i)a``executed=False`` means *command* is the content of a file that is only MENTIONED in inert (masked) text: it is still scanned for a literal lifecycle command, but "could not scan" (budget, depth, size, device, live SQLite, cloud) is "nothing to scan" there, never a block (#113944).rFTc(V^8dQhRRRRRRRR/#)rrrrrrrr r )r!s"rr"5_contains_unsafe_gateway_action..__annotate__Ts(  c   $ rc 4<\WS^,SSSVR7#)r~)rrrrrr)_contains_unsafe_gateway_action)rrrrrrrs&&&rrecurse0_contains_unsafe_gateway_action..recurseTs". GF1H  rrrr ze` lives on a cloud-synced path (iCloud Drive / ~/Library/CloudStorage) that the guard refuses to openpathsrz remote readsz.` read from the backend exceeds the scan cap (r )rrrs_MAX_REFERENCED_SCRIPT_DEPTHrrrrrrryraddrrrrrrrr)r7rrrrrrrr walk_commandpayloadr r{rcandidate_executedrrrs&$dddd$ rrrEsi   g & &;C 7NNg&& ,,  ?-g6L/ = 7 * *>0Nl/de/dt"/dJe1OPW1ab1ae}1abb +5' + & &!)K }%MM #K0 w  !!##!(%@@ @ ?  H6kVMcMcd V !)&+?QR]?^__   #5#A,,..%,V^UKK" !#?"3{#34@V@V# K%- K=)899]_   ; 9#h- H O OCQc d d_,6` ifbs  I5 I:c(V^8dQhRRRRRRRR/#) rr7rrrrrr ztuple[bool, Optional[str]]r )r!s"rr"r"s4#I#I #I'#I5#I #Irc J\4p\W^\4VVR7pYD'dVP3#R3# \d\\ P RRR7\T4R3u# \d&\T4;'g \T4R3uu#i;ii;i)u1``(unsafe, refusal)``: *refusal* names a non-lifecycle reason the walk failed closed (budget, size, device, live SQLite, cloud) so callers can tell the model; ``None`` when the verdict is a real lifecycle command or the command is allowed. Total by construction: never raises. Direct scans are pure string ops; the referenced-script walk (filesystem, remote backends, shlex on decoded bytes) is best-effort defense-in-depth — an unexpected failure is logged and treated as "walk found nothing". This is the contract #76762 established ("a guarded path must never crash the guard") enforced at the boundary instead of per-syscall: a guard crash propagates out of ``tools/terminal_tool.py`` and breaks every terminal command until the gateway restarts (#77780, #78256), which is strictly worse than either verdict. )rrrrrNzRlifecycle guard referenced-script walk failed; falling back to direct-scan verdictT)exc_info) rrr3rrrrrsrrZ)r7rrrrs&$$ rscan_gateway_lifecyclers"" #FI0 AsuV1 v~~99T99  I 2   I)'2D8 8 I6w?BB8ADI I I Is7,<<"B" A.+B".B BB"BB"c(V^8dQhRRRRRRRR/#) rr7rrrrrr rr )r!s"rr"r"s4^^ ^'^5^ ^rc*\WVR7^,#)zuDetect lifecycle/submit commands, including bounded nested scripts (see ``scan_gateway_lifecycle`` for the contract).)rr)r)r7rrs&$$r7contains_gateway_lifecycle_command_or_referenced_scriptrs "'GY Z[\ ]]rc$V^8dQhRRRRRR/#)rpromptrscriptr rr )r!s"rr"r"s"> > M> => TX> rcTT;'gRpRpRpV'dc\V4pVe\V4'd \R4hVRJ;'dVPR8Hp\ V4wrdV'dV RV 2pV'dRpMpV'dH\ 4pVP V4'g\VR^4pVPpM-\V4pM!\Y!'d \V4MRR 7wrtV'dV'd\R V R 24hV'd \R 4hR#) aRaise ``GatewayLifecycleBlocked`` if *prompt* or *script* contains a gateway-lifecycle command. The script is read from disk and concatenated with the prompt so a command cannot slip through by being split across the two. Callers let the ``ValueError``-shaped exception propagate.rFNa<Blocked: the cron script lives on a cloud-synced path (iCloud Drive / ~/Library/CloudStorage). Opening an evicted FileProvider placeholder can hang the guard's preflight scan indefinitely, so it is refused without being read. Move the script to a local, non-cloud path (e.g. ~/.hermes/scripts/) and recreate the job.z.pyrTrrzPBlocked: the lifecycle guard could not scan this cron job or referenced script: z. Nothing in the job is known to contain a gateway lifecycle command, but a script the job executes must be scannable (a regular text file under 1 MiB) before it can run.aBlocked: cron job contains a gateway lifecycle command or persistent launchctl submit operation. This is blocked to prevent agent-driven SIGTERM-respawn loops under launchd/systemd supervision (#30719). Run `hermes gateway restart` from a shell outside the running gateway instead.) rrrsuffixrrrrrrprr) rrcombined python_scriptrresolved_scriptrrrs && rcheck_gateway_lifecyclers1 ||HM!G .v6  &>/+J+J) B  (t3WW8N8NRW8W 8@ "2k]3H &'!!(++&vvq9FnnG@JF0 v3F;4 '%^_f^ghf f  % +  r>-A-F-G-O-P-U-d-grO-s-tr--ns--uid--euid--group--older--cgroup--nslist--parent--pgroup--signal --pidfile --session --terminal --delimiter --runstates--ignore-ancestors> -Zr-orr-yrrr --context --older-than--younger-than>-Sr# --omit-pid --separator>rrr\ stop-process>rrr`>shkshzshbashdash>+O+or r#i> agrgackgreppsqlegrepfgrepsqlite3 journalctl)r z$(z<(z>(z\!>rrrexecrrnohuprrsetsidrbuiltinr7rrrrr eatmydatar> r-Tr r-prOrrrr--prompt>rr(r--chdir--unset--split-string>rrrB--class --classdata>-e-ir#--error--input--output>-krr --kill-after>r rrr--shell --supp-group>r rrrrrrPrQ>--regid--reuid--groups --inh-caps--ambient-caps--bounding-set--selinux-label--apparmor-profile> -ErBr--gidr--unit--slice--setenv --property --description --on-calendar--service-type> r r(rOr-w--wd--root--setgid--setuid--target>-Rrcrdre --map-user --map-group --setgroups)r(rF)rr) sELFssssssMZs!ssPKir)rr __future__rloggingrrjr)rsyspathlibrtypingrrr getLoggerr rr9rcompilerr/rr2r)r.rErgr@rDrrrrCHOST_INTERPRETER_KILL_REJECTIONr4rIrsr}rrrrrrrrrrrr4rrhrcrbrgrr_ReadRemoteScriptFnrBrCrrGrFrArrrrrrrrrrrrrrrrr#r.r5rryrIrPrxrZrmrprsryrrrrrrrrrrrrrrrrrrrr rrrvs# //   8 $LjL  ZZ#P%\ #LM>Annncnn-2288:RT Y y;< "7w!?g!*+T!Ug JJ. / ZZ0JK ?@ DE JJ'pqQ  F5 F`&(]V 8::&67 K0#%** %#,!# ]!::&DECD&'?@k** 7# '(:N'KL #R : >2zzI uhsm34!*+! ] T4L E T> " : B 7 xj B W 9Z c Y!%!, #  "!*1~**89  "T?kT9!!* #% 55pE w 2" + %<b 3"%5PU b ( $&$9N < <,+.2,?9.2?9D7;. #X8<XOSXv#I*.#I8<#IL^*.^8<^> > r