+ lHj,aRt0tRt^RIHt^RIt^RIt^RIt^RIt^RIt^RI H t ^RI H t H t ^RIHt^RIHt^RIHtHtHtHtHtHtHtHtHt^RIHtHtHtH t ^R I!H"t"H#t#H$t$H%t%H&t&^R I'H(t(^R I)H*t*H+t+H,t,^R I-H.t.]P^!]04t1] !]Pd!R R44t3]^k]Ph!4t5/t6]^k/t7]^k]8!4t9]^k]8!4t:]^k]8!4t;]^k/t<]^k/t=]^kRt>RRlt?RRlt@RRltARRltB/tC]^k/tD]^ kRRltERRltFRRRlltGRR ltHR!R"ltIR#R$ltJR%R&ltKR'R(ltLR)R*ltMR+R,ltNR-R.ltOR/R0ltPR1R2ltQR3R4ltRR5R6ltSR7R8ltTR9R:ltUR;R<ltVR=R>ltWR?R@ltXRARBltYRCRDltZRERFlt[RGRHlt\RIRJlt]RKRLlt^RMRNlt_RORPlt`/ta]^ kRQRRltbRSRTltcRURVltdRWRXlteRYRZltfR[R\ltg]h!0Rm4ti]h!0Rm4tjRR`RalltkRbR]/RcRdlltlReRfltmRgRhltnRiRjltoRkRlltp]!RmRn7!RoRp44tq]q!RqRrRsRtRu4tr]q!RvRwRxRyRz4tsR{R|lttR}R~ltu]!RmRn7!RR44tvRtwRtx]v!R]RmRmRRmRR]w,R,RR]w,R,R]w,R,RR7 ty]v!R^RmRmRmRmRRRR]x,R,RRR7 tz]v!R_RRRRRR]x,R,RR]x,R,RRR7 t{RRlt|RRRR/RRllt}RRRllt~RRRRRbRRRRRRRRRRRRR/ RRlltRRRlltRRltRR/RRlltRRRlltRRRR/RRlltRRRlltRtRRltRRRllt]c!4R#)acDangerous command approval -- the gate flow and per-session state. Owns the session state (approvals, yolo, gateway queues, denial breaker), the three guard entry points (``check_all_command_guards``, ``check_execute_code_guard``, ``request_tool_approval`` / ``_run_approval_gate``) and the shared human-decision engine behind them. Leaves: ``approval_detection`` (hardline/dangerous patterns), ``approval_context`` (contextvars, config readers), ``approval_floors`` (pre-gate blocks, allowlist match), ``approval_prompt`` (CLI prompt, plugin transports, MCP elicitation), ``approval_gateway_wait`` (blocking gateway round-trip), ``approval_smart`` (guardian LLM), ``approval_human_wait``. Leaves read facade-owned state (``_lock``, queues, denial breaker) back through ``tools.approval`` at call time; sibling-defined names are imported from their defining module. ) dataclassN)Optional)env_var_enabledis_truthy_value)t)approval_context) _get_session_platform_is_cron_approval_context_is_gateway_approval_context_is_interactive_cli!_is_single_query_approval_context(_is_unattended_platform_approval_context_resolve_cli_approval_callback$_should_fall_through_to_cli_approvalget_current_session_key)_approval_key_aliases_check_sudo_stdin_guarddetect_dangerous_commanddetect_hardline_command)$_command_matches_permanent_allowlist_hardline_block_result_match_user_deny_rule_sudo_stdin_block_result_user_deny_block_result)_await_gateway_decision) _present_with_selected_transport_transport_choiceprompt_dangerous_approval)_smart_verdictHERMES_YOLO_MODEc$V^8dQhR\/#returnint)formats"3/home/ubuntu/.hermes/hermes-agent/tools/approval.py __annotate__r*Hssc\\P!4PR^44# \\ 3d^#i;i)zJ``approvals.denial_breaker_threshold``: default 3; 0 or negative disables.denial_breaker_threshold)r'r_get_approval_configget ValueError TypeErrorr+r)_get_denial_breaker_thresholdr3HsB#88:>>?Y[\]^^  "s-0AAc0V^8dQhR\R\/#r$ session_keyr%)strr')r(s"r)r*r*Psr+c 6\;_uu_4\PV^4^,pV\V&\\4\8d.\P\ \ \444KEVuuRRR4# +'giR#;i)zIncrement and return the session's consecutive guardian-denial count. Pop-and-reinsert keeps actively-denying sessions at the most-recent end so eviction drops idle keys.N)_lock _denial_tallypoplen_DENIAL_TALLY_MAX_SESSIONSnextiter)r6counts& r)_record_denialrAPs_ !!+q1A5%* k"- #==   d4 #67 8 s A-B B c(V^8dQhR\RR/#r$r6r%Nr7)r(s"r)r*r*[s----r+c\;_uu_4\PVR4RRR4R# +'giR#;i)zDClear the session's consecutive-denial tally (an approval happened).N)r9r:r;r6s&r)_reset_denialsrG[s# +t, s 0 A c0V^8dQhR\R\/#r5rD)r(s"r)r*r*as##r+c\;_uu_4\PV^4pRRR4\4pV^8:gXV8dR#\P RWV4RV R2# +'giLG;i)zEscalated hard-stop text once the breaker has tripped, else ''. Read-only: callers increment via :func:`_record_denial`; the text is appended verbatim to the deny message.Nr z\Smart-approval circuit breaker tripped for session %s: %d consecutive denials (threshold %d)z CIRCUIT BREAKER: z consecutive commands were blocked by the security reviewer. STOP attempting variations of this operation. Report the blocked operation to the user and either ask them to run it manually or use /approve.)r9r:r/r3loggerwarning)r6r@ thresholds& r)_denial_breaker_addendumrMasq !!+q1 -/IA~* NNfI UG$v v s A%% A5 c(V^8dQhR\RR/#rCrD)r(s"r)r*r*~s...T.r+cn\;_uu_4V\V&RRR4R# +'giR#;i)uRegister ``cb(approval_data: dict) -> None`` for sending approval requests. The callback bridges sync→async: it runs in the agent thread and must schedule the send on the loop.N)r9_gateway_notify_cbs)r6cbs&&r)register_gateway_notifyrR~s  +-K(  # 4 c(V^8dQhR\RR/#rCrD)r(s"r)r*r*s34r+c\;_uu_4\PVR4\PV.4FpVPP 4K RRR4R# +'giR#;i)zUnregister the callback and wake ALL blocked threads for this session so they don't hang forever (agent run finished or interrupted).N)r9rPr;_gateway_queueseventsetr6entrys& r)unregister_gateway_notifyr[sJ  T2$((b9E KKOO : s AA'' A8 Fc V^8dQhR\R\R\R\\,R\\,R\/#)r$r6choice resolve_allreason request_idr%)r7boolrr')r(s"r)r*r*sH""#"s"*."%-c]"*2#"CF"r+c\;_uu_4\PV4pV'g RRR4^#V'ddVUu.uF&qfPPR4V8XgK$VNK( ppV'g RRR4^#VUu.uF qfV9gK VNK upVR&M6V'd\ V4pVP 4MVP ^4.pV'g\P VR4VF1pWnV'dW6nVPP4K3 RRR4\X4#uupiuupi +'giL%;i)aGUnblock waiting agent thread(s) from the gateway's /approve or /deny handler. *resolve_all* resolves every pending approval (``/approve all``); otherwise the oldest (FIFO) or the one matching *request_id*. *reason* is the ``/deny `` free text, relayed to the agent in the BLOCKED message. Returns the number resolved. Nr`:NNN) r9rVr/datalistclearr;resultr_rWrXr<)r6r]r^r_r`queuerZtargetss&&&&& r)resolve_gateway_approvalris ##K0  */^%::>>,3OS]3]uu%G^ ,1I5%4H5IE!H 5kG KKMyy|nG    T 2E!L% KKOO  ' 0 w<'_J sSE E E !E*E0 E E  EEE +5E !A E  E  E cHV^8dQhR\R\R\R\/#)r$r6r`causer%r7ra)r(s"r)r*r*s)3CPTr+cra\;_uu_4\PV.4p\V3RlV4R4pVf RRR4R#VP V4V'g\P VR4W$nVPP4RRR4R# +'giR#;i)uWithdraw one pending approval nobody can answer (the only attached client cannot render it). The waiter wakes at once with ``cancelled=cause`` — a withdrawal, never a user deny — instead of idling for the whole approvals.timeout (#112548). False when it is no longer pending.c3j<"TF(qPPR4S8XgK$VxK* R#5i)r`N)rcr/).0er`s& r) ,withdraw_gateway_approval..s%QA&&**\*Bj*Paas!3 3NFT) r9rVr/r>remover; cancelledrWrX)r6r`rkrgrZs&f& r)withdraw_gateway_approvalrus ##K4QQSWX =   U    T 2     s2B% B%%6B%% B6 cFV^8dQhR\R\\,/#r5)r7rddict)r(s"r)r*r*s"TTTT Tr+c\;_uu_4\PV.4Uu.uFp\VP4NK upuuRRR4#uupi +'giR#;i)zEReturn replay-safe snapshots of unresolved approvals for one session.Nr9rVr/rwrcrYs& r)list_gateway_approvalsrzsE .=.A.A+r.RS.RUUZZ .RS S sAAAA A) c<V^8dQhR\R\R\/#r$r6r`r%rl)r(s"r)r*r*s!#$r+c\;_uu_4\PV.4F4pVPPR4V8XgK%W#nRRR4R# RRR4R# +'giR#;i)zAttach ``settle(reason)`` to one pending approval; it runs once when that wait ends by any path. False when the request is no longer pending (the surface should withdraw its prompt itself).r`NTF)r9rVr/rcsettle)r6r`r~rZs&&& r)register_gateway_settlersY $((b9Ezz~~l+z9%  9    s7A( A(A(( A9 c<V^8dQhR\R\R\/#r|rl)r(s"r)r*r*s!cstr+c\;_uu_4\PV.4F5pVPPR4V8XgK%RVnRRR4R# RRR4R# +'giR#;i)zDRecord that a client received a particular pending approval request.r`TNF)r9rVr/rc acknowledged)r6r`rZs&& r)ack_gateway_approvalrsZ $((b9Ezz~~l+z9%)" 9    s7A) A)A)) A: c0V^8dQhR\R\/#r5rl)r(s"r)r*r*s66s6t6r+c\;_uu_4\\PV44uuRRR4# +'giR#;i)zFCheck if a session has one or more blocking gateway approvals waiting.N)r9rarVr/rFs&r)has_blocking_approvalrs& O'' 45 s 8 A c$V^8dQhR\/#r#r&)r(s"r)r*r*sEEEr+c\;_uu_4\R\P444uuRRR4# +'giR#;i)u[Unresolved gateway approvals across every session — a backend blocked on one is not idle.c38"TFp\V4xK R#5iN)r<)rorgs& r)rq1pending_gateway_approval_count..sD+C%3u::+CsN)r9sumrVvaluesr2r+r)pending_gateway_approval_countrs* D?+A+A+CDD s $> A c>V^8dQhR\R\R,/#rCr7rw)r(s"r)r*r*s # #c #dTk #r+cV'gR#\;_uu_4\PV4pV'g RRR4R#\V^,P4uuRRR4# +'giR#;i)uCopy of the oldest unresolved gateway approval, for reconnecting clients to restore a prompt. Read-only snapshot — the queue stays authoritative.Nry)r6rgs& r)get_pending_gateway_approvalrsJ  ##K0 E!HMM" sA(A(( A9 c0V^8dQhR\R\/#)r$r6approvalr)r(s"r)r*r*s)))t)r+cn\;_uu_4V\V&RRR4R# +'giR#;i)z/Store a pending approval request for a session.N)r9_pending)r6rs&&r)submit_pendingrs  ( rSc0V^8dQhR\R\/#)r$r6 pattern_keyrD)r(s"r)r*r*sJJJ3Jr+c\;_uu_4\PV\44P V4RRR4R# +'giR#;i)z(Approve a pattern for this session only.N)r9_session_approved setdefaultrXadd)r6rs&&r)approve_sessionrs0 $$[#%8<<[I s .A A c(V^8dQhR\RR/#rCrD)r(s"r)r*r*s q qS qT qr+cx^RIHpV!V4R# \d\P RTRR7R#i;i)aDrop resources whose immutable mode derives from Hermes YOLO. Lazy import so approval-only sessions never load computer-use; releasing on BOTH edges makes enabling YOLO replace a standard backend and disabling it revoke a private unrestricted daemon immediately.)release_computer_use_sessionz{ K` "   sBC5 &D5 D  DDc0V^8dQhR\R\/#r5rl)r(s"r)r*r*:s,,,,r+cV'gR#\;_uu_4V\9uuRRR4# +'giR#;i)z?Return True when YOLO bypass is enabled for a specific session.FN)r9rrFs&r)is_session_yolo_enabledr:s!  m+ s - > c$V^8dQhR\/#r#ra)r(s"r)r*r*BsHHHr+c,\\RR74#)zEReturn True when the active approval session has YOLO bypass enabled.r default)rrr2r+r)is_current_session_yolo_enabledrBs "#:2#F GGr+c$V^8dQhR\/#r#r)r(s"r)r*r*Gsdr+cX\'g\4'dR#^RIHpV!4#)zCLI ``--yolo`` (process-scoped, frozen at import) or gateway ``/yolo`` (session-scoped). Hardline / deny-rule floors run BEFORE this everywhere.Tunattended_turn)_YOLO_MODE_FROZENrgateway.session_finiterrs r) _yolo_activerGs";==6  r+c$V^8dQhR\/#r#rX)r(s"r)r*r*Psr+c^RIHpHpV!4f \Rr2M%V!4p\P V\ 44p\W#4V#)uThe permanent allowlist that governs the ACTIVE profile. Unscoped (single-profile process, or the multiplexer's own launch profile) → the module-level set tests and the CLI seed. A routed profile (HERMES_HOME override) → its own set, lazily loaded from ITS ``command_allowlist``: the launch profile's "always" approvals must not pre-approve commands for a secondary, nor may a secondary's "always" choice be written back into the launch profile's config. Callers hold ``_lock``. get_hermes_home_overridehermes_home_keyr )hermes_constantsrr_permanent_approved_permanent_approved_by_homerrX_sync_permanent_from_disk)rrapprovedkeys r)_permanent_setrPsAK!)+R#.99#suEh, Or+c4V^8dQhR\R\RR/#)r$rrr%N)rXr7)r(s"r)r*r*as!///#/$/r+c8\4p\P T\ 44pY$8XdR#TPYB, 4TPY$, 4T\T&R# \d$p\PRTRR7Rp?R#Rp?ii;i)acApply hand edits to ``command_allowlist`` made since the last sync. The gateway daemon outlives any one session, so an entry the operator removed must stop being honoured now, not at restart. Only the on-disk delta is applied: approvals this process made but could not save survive. The config read is cached on the file signature. Callers hold ``_lock``.&Failed to load permanent allowlist: %sTrN) _read_permanent_allowlistrrJrK_permanent_baseline_by_homer/rXdifference_updateupdate)rron_diskrpbaselines&& r)rras +-+..sCE:H x12 OOG&''.$ ?TRs A++ B6BBc<V^8dQhR\R\R\/#)r$r6rr%rl)r(s"r)r*r*ss!77S7s7t7r+c<a\V4p\;_uu_4\4\P V\ 44,oRRR4\ ;QJdV3RlV4F 'gK R# R#!V3RlV44# +'giLJ;i)zSession-scoped or permanent approval. Accepts the canonical key and the legacy regex-derived key so existing command_allowlist entries survive key migrations.Nc3,<"TF qS9xK R#5irr2)roaliasrs& r)rqis_approved..ys6gU gsTF)rr9rrr/rXany)r6raliasesrs&& @r) is_approvedrssg$K0G !#&7&;&;K&OO  36g63363636g6 66 s .B  B c0V^8dQhR\R\/#)r$rr%rl)r(s"r)r*r*|sCC#C$Cr+c\V4p\;_uu_4\;QJdRV4F 'gK RM RM !RV44uuRRR4# +'giR#;i)zFPermanent approval only, with compatibility for migrated pattern keys.c3:"TFq\49xK R#5ir)r)rors& r)rq+_is_permanently_approved..sB'N,,'sTFN)rr9r)rrs& r)_is_permanently_approvedr|s;#K0G sB'BsssB'BB sAA A* c$V^8dQhR\/#)r$rrD)r(s"r)r*r*s**3*r+c\;_uu_4\4PV4RRR4R# +'giR#;i)z)Add a pattern to the permanent allowlist.N)r9rr)rs&r)approve_permanentrs$ [) s 3 A c$V^8dQhR\/#r$patternsr)r(s"r)r*r*s##S#r+c\;_uu_4\4pVP4VPV4RRR4R# +'giR#;i)z2Bulk-load permanent allowlist entries from config.N)r9rrer)r governings& r)load_permanentrs3 "$ " s ,A A cVV^8dQhR\R\R\\,RR/#)r$r6r]keysr%N)r7rd)r(s"r)r*r*s, - - -c -c -t -r+c <VFpVR9dK \W4VR8XgK \V4\;_uu_4\4\P \ 4\44, pRRR4\X4K R# +'giL!;i)z^Persist a human ``session``/``always`` choice for each pattern key. ``once`` persists nothing.alwaysN)sessionr) rrr9rrr/ _baseline_keyrXsave_permanent_allowlist)r6r]rrgrantss&&& r)_persist_choicersm . .  ) X  c "'),G,K,KMO]`]b,cc $V ,s 6B  B c$V^8dQhR\/#r#r)r(s"r)r*r*s3r+c^RIHpV!4pVPR4p\V\4pV'd^RIpVP V4pVf V'g.p\V\4'd;\;QJdRV4F 'gK RM RM !RV44'd \PR4\4#V'd\PR4\V4# TPdRpLi;i) zY``command_allowlist`` of the active profile's config as a set (empty on malformed input).)load_config_readonlycommand_allowlistNFc3L"TFp\V\4'*xK R#5ir) isinstancer7)roitems& r)rq,_read_permanent_allowlist..s'RcdJtS,A(A(Acs"$TzBIgnoring malformed command_allowlist; configure a list of strings.zKRecovered legacy string command_allowlist; re-save it as a list of strings.) hermes_cli.configrr/r r7 hermes_yaml safe_load YAMLErrorrdrrJrKrX)rconfigrawlegacyyamls r)rrs6 ! #F **( )C S !F " ..%C {6 c4 CC'Rc'RCCC'Rc'R$R$R[\u  de s8O~~ C sC22DDc$V^8dQhR\/#r#rD)r(s"r)r*r*sKKsKr+c6^RIHpHpV!4fR#V!4#)rr )rrrrs r)rrsJ)+32J9JJr+c$V^8dQhR\/#r#r)r(s"r)r*r*s  # r+c,\4p\V4\;_uu_4\V4\\ 4&RRR4V# +'giT#;i \ d+p\PRT4\4uRp?#Rp?ii;i)zLoad ``command_allowlist`` from config and sync it into the approval state so is_approved() honors 'always' choices from previous sessions.Nr) rrr9rXrrrrJrK)rrps r)load_permanent_allowlistrsi,.x U;>x= '  8U ?Cu s:#AA  A A AA B)BBBc$V^8dQhR\/#rr)r(s"r)r*r*s::s:r+cL^RIHpHpV!4p\VP R.4;'g.4p\ ;_uu_4\ 4p\P V\44pV\V4V, ,p\V4VR&V!V4\V4\V&\4pVP4VPV4RRR4R# +'giR#;i \d"p \PRT 4Rp ? R#Rp ? ii;i)aSave permanently allowed command patterns to config, reconciling with the file. ``command_allowlist`` is a file an operator edits by hand; removing an entry there is the documented way to withdraw a standing approval. This process read it once at import and ``load_permanent`` only ever unions, so writing the in-memory set straight back deleted entries added on disk since import and resurrected the ones removed. The result written is ``what is on disk now`` plus ``what this process approved since its own baseline``; revoked entries are also dropped from the governing permanent set so ``is_approved()`` stops honouring them (``_sync_permanent_from_disk`` does the same on every check). ``patterns`` may only ADD: an entry left out of it is not removed, because the on-disk list wins for anything this process did not approve itself. Remove entries by editing ``command_allowlist`` in config.yaml. ) load_config save_configrNzCould not save allowlist: %s)r rrrXr/r9rrsortedrrerrrJrK) rrrrrrrmergedrrps & r)rrs :>fjj!4b9??R@ U/C266sCEBHH  89F*0.F& '  /26{ ' ,&(I OO    V $UUU :5q99:s;,C7C7BC#C7# C4 .C74C77 D#DD#c0V^8dQhR\R\/#r5rl)r(s"r)r*r*syysytyr+ct\;'g,\V4;'g\P!4R8H#)uCanonical three-source bypass check: process ``--yolo`` (frozen at import), the session-scoped gateway ``/yolo`` toggle, ``approvals.mode: off``. Pure bypass sub-expression only — hardline blocklist / permanent allowlist are the caller's job.off)rrr_get_approval_moderFs&r)%is_approval_bypass_active_for_sessionr%s0  w w!8!E w wIYIlIlInrwIwxr+c$V^8dQhR\/#r#r)r(s"r)r*r*sVV4Vr+c,\\RR74#)z?Return whether the current approval context has bypass enabled.r r)r%rr2r+r)is_approval_bypass_activer(s 01HQS1T UUr+c$V^8dQhR\/#r#)rw)r(s"r)r*r*s//4/r+cRRRR/#)rTmessageNr2r2r+r) _approvedr,s i ..r+commandcodeactionc<V^8dQhR\R\R\/#)r$outcomenounr%rD)r(s"r)r*r*s!1131c1#1r+c^RIHpHpV!V!44pV\9dRV 2MRpV\9d\ RV 24MTp\ WVVR7#)r)_get_approval_timeoutformat_approval_windowzapproval.summary.zapproval.summary.defaultzapproval.noun.)r2window)tools.approval_contextr4r5_USER_SUMMARY_OUTCOMES_USER_SUMMARY_NOUNSr)r1r2r4r5r6r noun_texts&& r) _user_summaryr;sST #$9$; G ".(MD%@;(     }k8EX w { G }UNNUYV[]   7 7( 7DE=+xASD)Wm[k]"EdVL??CyykJW W F 4 ? Mr+T)frozencpa]tRtRtoRtV3RlRltV3RlRlt]V3RlRl4tV3R lt R t Vt R #) _Unattendedi]zGOne non-interactive context and the text every gate uses to explain it.c <V^8dQhRS[/#r#rD)r( __classdict__s"r)r*_Unattended.__annotate__fsNNcNr+cH\\RVP R24!4#)_get__approval_mode)rrnameselfs&r)mode_Unattended.modefs '5 >)JKMMr+c2<V^8dQhRS[RS[RS[RS[/#)r$subjectr2advicer%rD)r(r`s"r)r*rajs/FFSF3FFFr+c hRV RVP RV RV RVP RVP R2 #) BLOCKED: z but z. z To allow  z, set approvals.z: approve in config.yaml.)clausescopecfg_key)rgrkr2rls&&$$r) block_message_Unattended.block_messagejsLG9E$++b 4&PQRVR\R\Q]^!\\N*CE Fr+c <V^8dQhRS[/#r#rD)r(r`s"r)r*raos\\3\r+cVP^,P4 VPR, RVP RVP R2#)r:NNz-. Use normal tools instead, or set approvals.z: approve only if .)rpupperrrtrustrfs&r) exec_tail_Unattended.exec_tailnsN;;q>'')*4;;r?*;<--1\\N:LTZZLXY[ \r+cV<V^8dQh/S[;R&S[;R&S[;R&S[;R&S[;R&#)r$rerrrprqrzrD)r(r`s"r)r*ra]sA IL  K  J  Jr+r2N) __name__ __module__ __qualname____firstlineno____doc__rhrspropertyr{__annotate_func____static_attributes____classdictcell__r`s@r)r^r^]s=QNNFF\\%r+r^ single_querysingle_query_modez@single-query mode (-q) runs without a user present to approve itzin single-query modez.this single-query run is intentionally trustedcron cron_modez2cron jobs run without a user present to approve itz in cron jobsz*this cron profile is intentionally trustedc:V^8dQhR\\,/#r#)rdr^)r(s"r)r*r*sd;/r+c .p\4'dVP\4\4'dVP\4V#\ 4'd+VP\ RRR\4 R2RR44V#)zActive unattended contexts in evaluation order: single-query first (``hermes chat -q`` exports HERMES_INTERACTIVE=1 but nobody answers); cron beats a platform marker because cron binds the platform for delivery routing only. unattendedunattended_modez-this session runs on an unattended platform (z$) with no user present to approve itzon unattended platformsz2sessions on this surface are intentionally trusted)r append_SINGLE_QUERY_CTXr _CRON_CTXr r^r)contextss r)_unattended_contextsrsH(**)* "" " O 2 3 3 + %'((L N %'[   Or+cJV^8dQhR\R\R\R,/#)r$r-ctxr%N)r7r^rw)r(s"r)r*r*s%c t r+caSP4R8wdR#RV3Rllp\V4wr4pV'dC\V4'g2V!RV R24pSPR8XdVP WER7V#R#) zRDeny-mode handling for one unattended context (cron / -q / webhook); None = allow.denyNc0V^8dQhR\R\/#)r$rkr%r)r(s"r)r*&_unattended_deny..__annotate__sNNsNtNr+c 4<RRRSPVRRR7/#)rFr+dangerous commands6Find an alternative approach that avoids this command.r2rl)rs)rkrs&r)block_unattended_deny..blocks3E9c.?.? .K/@/MN Nr+Command flagged as dangerous ()rrr=)rhrrrer)r-rr is_dangerousrr=rfs&f r)_unattended_denyrsv xxzVNN .Fg-N*L{4[AA7 }AFG 88~ % MMkM K r+c,a]tRtRtoV3RltRtVtR#) _GateSpecic<V^8dQh/S[;R&S[;R&S[;R&S[;R&S[;R&S[;R&S[;R&S[;R&S[;R &S[;R &S[;R &#) r$r2 transportrH redact_clirX notify_failedgateway_refusedtransport_denied cli_timeout cli_denied smart_logrl)r(r`s"r)r*_GateSpec.__annotate__s IO     ONr+r2N)r~rrrrrrrs@r)rrsr+ra The user has NOT consented to this action. Do NOT retry this command, do NOT rephrase it, and do NOT attempt the same outcome via a different command. Stop the current workflow and wait for the user to respond before taking any further destructive or irreversible action.z The user has NOT consented to this action. Do NOT retry it, do NOT rephrase it, and do NOT attempt the same outcome via a different path.z?BLOCKED: Failed to send approval request to user. Do NOT retry.z+BLOCKED: Command {reason}.{reason_addendum}z{timeout_addendum}{breaker}zBLOCKED: User denied this command through the selected approval transport. The user has NOT consented to this action. Do NOT retry or attempt the same outcome through another route.{breaker}z1BLOCKED: Command timed out without user response.z! Silence is not consent.{breaker}z"BLOCKED: User denied this command. {breaker}z9Smart approval: auto-approved '{command}' ({description})) r2rrHrrXrrrrrrzLBLOCKED: Failed to send execute_code approval request to user. Do NOT retry.zBLOCKED: execute_code script {reason}.{reason_addendum} The user has NOT consented to running this code. Do NOT retry, do NOT rephrase the script, and do NOT attempt the same outcome via a different tool.{timeout_addendum}{breaker}zfBLOCKED: User denied execute_code through the selected approval transport. The user has NOT consented.z0BLOCKED: Action timed out without user response.uBLOCKED: User denied execute_code script execution (matched '{description}'). Do NOT retry — the user has explicitly rejected it.{breaker}zDSmart approval: auto-approved execute_code for session {session_key}z*BLOCKED: Action {reason}.{reason_addendum}z{timeout_addendum} Silence is not consent.uBLOCKED: User denied this potentially dangerous action (matched '{description}'). Do NOT retry — the user has explicitly rejected it.cV^8dQhR\R\R\R\R\\,R\R\R\\ R ,\3,/#) r$rYr-r=rrNr6 human_presentr%N)rr7rdratuplerw)r(s"r)r*r*sZ  i # C c "3i 69 # (-dTk4.?(@ r+c 4\WW4V4pVR8XdO\V4\PVPP VR,W%R74RRRRRRR V/R 3#VR 8wdR#\ V4V'dR#RR RR V R \V4 2RR/R3#)uGuardian-LLM step -> ``(result, smart_denied_for_owner)``: a result ends the gate; ``smart_denied_for_owner`` means an interactive owner may still override the DENY for this one operation (once/deny only, nothing persists). APPROVE approves this command only — pattern-level persistence would let one benign command suppress review of later commands in the same broad detector category. A DENY counts toward the denial breaker even when an owner may override it. ESCALATE follows the normal, potentially persistent manual behavior. approve:N<N)r-r=r6rTr+Nsmart_approvedr=FrzBLOCKED by smart approval: z@. The command was assessed as genuinely dangerous. Do NOT retry.rPNF)NT)rrGrJrrr(rArM)rYr-r=rrNr6rverdicts&&&&&&$ r) _smart_gatersW;kZG){# T^^**73<[*rsD)T3CT=Zefhmmm&; E1+?//G /T.UW     r+smart pending_bodycV^8dQhR\R\R\R\R\\,R\R\R\R \R \R \/ #) r$rYr-r=rrNr6is_cli is_gatewayis_askrr%)rr7rdrarw)r(s"r)r*r*szFF)FF3F!$F48IF!$FAEFSWF!F*.FNRFr+c aaaaaa^RIHp RoV 'd0\STSSSST;'g T;'gT R7wp oV eV #V 'dV !4MRp S'*pRVVVV3RllpRVVVVV3RllpSP'd\ TSSSSS'*TV'g V 'd\ P !4MR R 7p\VSSR 7wppVeV#Ve.VR 8Xd\S4V!SPR 4#V!V4#V'g V 'EdV !V4pV !S4p\S4pVEe$RVRSRSRVRS'*RS'*/pS'dRVR&\SVVRR7pVPR4'd%\SPSSRSPR7#VR,VPR4ppVPR4'd$V!SP RRVR, R2RRRR 7#VR!,'gV!SP R"R#RR$VR 7#VeVR 8Xd'T!SP R R%V'dR&V R'2MRRVR 7#V!V4#\#WvVR(7'g*SP$'gTSpp\'SSVVSSV SR)7#TSppSP('dV !V4pV !S4p\+VVS\-S4SR R*7p\ P.!R//VB\1VVVSVR+7p\ P.!R0/VBRV/BVR"8XdV!SP2R"4#VR8Xd(V!SP RR,\5VR-R.4 R2RR$RR 7#VR 8XdV!SP6R 4#V!V4#)1aAsk a human (after the optional guardian-LLM step) and turn the answer into the gate result. ``pattern_keys`` are what :func:`_persist_choice` stores on session/always; a smart-DENY owner override reduces every surface to once/deny and persists nothing. ``pending_body`` is a thunk, built only once a human is actually asked, so a smart APPROVE never pays for redacting a large script. redact_sensitive_textF)rNc<V^8dQhR\R\R\/#)r$templater1r%r)r(s"r)r*%_human_decision..__annotate__1s&AAsASADAr+c <RpRV9d \S4pVPRR4pRV9dRV/M/p\VP!R RSRV/VB3RSRSRVR S P/VB#) r r deny_reasonNr_r=breakerrr1r2r2)rMr;rBr(r2) rr1fmtrrrAr=rr6rYs &&, r)r_human_decision..deny1s ( ".{;GggmT2 08C ,RxW;WWSVWA#.A.grant;s3 K >    !+{; ;{r+cli)r-r=rrNr6 allow_sessionrRsurfacerrdeniedr-rrNr=rRrTrPgateway)rrrr=r1r2r]r_rtz1approval was withdrawn before the user answered (rr )r_reason_addendumtimeout_addendumrresolvedtimeoutztimed out without user responserzdenied by userz Reason given by the user: "z".)rapproval_callback notify_cb)r-r=rrNrOrP)r-r=rrNr6r)rRrPrzRwas not approved: the approval prompt could not be delivered or was not answered (rkz no answer)pre_approval_request)post_approval_response) agent.redactrrrrrgateway_approval_surfacerrArrLrr/rBrr2rrrXr[rrwrd_fire_approval_hookrrrr)rYr-r=rrNr6rrrrrrrrfrRrrattemptr]rdisplay_commanddisplay_descriptionrrcdecisionrprompt_commandprompt_description hook_kwargsrPsf$dddd$$$$$$ @r)_human_decisionrs3L *4+{T`+6fFdFdPZFdFd^d f  M%1<>tL&&OAA ~~~2+\h#|3CUdDNRX$==?_d  +7 Yde  M  {+D118<<= VV083K@&{3  ?M; m=P!|#3\!1 D '+^$.{ItU^_H||O,,t11{+6VZV_V_aa #+8"4hll86LKF||K((D00+%VW_`kWlVmmn#o,.QUWWJ''D00)De,.A[(355~6!1D00(CS_j/KK=XZ-[pr-/[JJ= 4)  $$$7> !4"k?H[it) <  *1+&N .w72;?~;M[f$($6KY^`K((O;O &~7I[j4@TegF((`[`Y_` D$$i00 D((+&vw DEQH$&9Saeg gDOOX.. =r+c$V^8dQhR\/#r#)r)r(s"r)r*r*s 9 9 9r+c@\V4p\4\4r!\R4p\ 4'g\ 4'dR;p;r#MLV'dE\ 4'd5\\44e\4\P9dRpWW#3#)uJ``(approval_callback, is_cli, is_gateway, is_ask)`` for the current context. Single-query ``-q`` and cron clear the presence trio: ``hermes chat -q`` exports HERMES_INTERACTIVE=1 for sudo prompts, and a gateway sets HERMES_EXEC_ASK=1 at startup and passes its environ to every external cron worker (#110932) — in neither can a human answer the card, so the gate must resolve from ``approvals._mode`` instead of parking on a pending approval. Unattended *platforms* keep ``is_ask`` only while a client on the session could actually answer: ``/v1/runs`` and streaming chat completions bridge an approval notifier (``approval.request`` → ``POST /v1/runs/{id}/approval``), so on api_server a registered notifier is the discriminator. webhook/msgraph_webhook turns run through the generic TurnRunner lane, which registers a notifier for *every* turn — but those adapters render no approval surface and the inbound lane has no reader, so there ``is_ask`` drops regardless and the unattended branch resolves from ``approvals.unattended_mode`` instead of parking an unanswerable card (#100532).HERMES_EXEC_ASKF) rr r rr r r rLrrr"_NOTIFIER_BLIND_APPROVAL_PLATFORMS)rrrrs& r) _presencers77HI,.0L0NJ . /F(**.G.I.I',,,f <>>#$;$=>F)+/?/b/bb j 88r+rrkflagged actionsrl5Find an alternative approach that avoids this action.cron_deny_messagesingle_query_deny_messageunattended_deny_messagefail_closed_when_no_humanno_human_block_messagecV^8dQhR\R\R\R\R\R\R\R\R \R \R \R \R \/ #)r$rr=display_targetrkr2rlrrrautoapprove_log_prefixrrr%r7rarw)r(s"r)r*r*sFFF&)F;>F F F F F=@ F`c F  F =A F cf F  Fr+c \4'g\P!4R8Xd \4#\ 4p \ W4'd \4#\ V4wr>ppV'EgFV'Eg=V'Eg4WV3pRVRVRV /p\4FpVP4R8XdpVVP,pV'g+VPR8XdVPRV R2RR R 7pMV'gVPWEVR 7p\VWR 7u#VPR8Xd%\P!R .VO5!\4u#M= V 'd4\P!R .VO5!\T ;'gRV R2WR 7#\P!R.VO5!\4#\\W!VV.V W>VVR7 #)uShared human-approval gate for a flagged action (tool call or write): decision core for :func:`request_tool_approval` and the file-tool write gates. Order: yolo bypass → session-cache short-circuit → interactive/gateway/unattended branch → prompt → persistence. Input-shape checks (hardline, allowlist, pattern detection) are the caller's job. ``fail_closed_when_no_human``: a non-interactive, non-gateway, non-cron context without an ask bridge BLOCKS instead of auto-approving, so a plugin-flagged action never runs ungated. Unattended deny text is ``ctx.block_message(subject, noun, advice)`` unless the caller passes an explicit ``*_deny_message`` (the file-tool write gates word their own). r#rrrrzapproval required (rrrrruZ%s (pattern: %s): %s — single-query auto-approve (approvals.single_query_mode: approve).u%s (pattern: %s): %s — no interactive user/gateway present; BLOCKED (fail-closed). Set HERMES_INTERACTIVE or HERMES_GATEWAY_SESSION to answer the prompt.zBLOCKED: approval required (z>) but no interactive user or gateway is present to approve it.u^%s (pattern: %s): %s — set HERMES_INTERACTIVE or HERMES_GATEWAY_SESSION to require approval.) r-r=rrNr6rrrr)rrr$r,rrrrrhrersrErJrKr _ACTION_GATE)rr=rrrkr2rlrrrrrrr6rrrlog_args deny_messagesrr+s$$$$$$$$$$$$$ r)_run_approval_gaters,~~)<<>%G{)+K;,,{4=>O4P1z6 6**VV*E 5v?P 1 ()CxxzV#'1388|#;!//2Ek]RS0T[l7n0pG !//6/RG[ZZxx>) IUKSU {" !*$) NZPXZ 6!M!M2;-@LL +FF E QGO Q{ nS^!] +zZ` r+c<V^8dQhR\R\R\/#)r$env_typehas_host_accessr%rl)r(s"r)r*r*s"C$SWr+cVR8XdV'*#VR9dR#^RIHp\V!VRR44# \dR#i;i)zTrue when the backend is isolated enough to skip dangerous-command prompts. Docker is the exception once host paths are bind-mounted: ``rm -rf /workspace`` then reaches host files.dockerT) provider_flagskip_container_guardsF)modaldaytonavercel_sandbox)agent.terminal_env_registryrrar)rrrs&& r)_should_skip_container_guardsr sP8"""99=M(,CUKLL s2 AAc>V^8dQhR\R\R,/#)r$r-r%Nr)r(s"r)r*r*"s11c1dTk1r+ct\V4pVfR#\PRWR,4\V4#)uThe operator's ``approvals.deny`` rules are documented as never bypassable — not by yolo, not by mode=off, and not by an isolated container either: they express intent about what the agent may DO, not what it can reach, so they are evaluated before the container fast path.Nz%User deny rule %r blocked command: %sNN)rrJrKr)r- deny_patterns& r)_user_deny_blockr"s6)1L NN:LRV-X "< 00r+ sudo_guardcJV^8dQhR\R\R\R,/#)r$r-rr%Nr)r(s"r)r*r*-s%%%#%d%td{%r+c^RIHp\V4wr4V'd)\P RW@R,4\ W@4#V!V4pV'd-\P RWPR,4\ RV 2V4#V'd>\ V4wrgV'd)\P RWpR,4\V4#\V4#)uUnconditional floors, BEFORE yolo / mode=off / cron approve-mode so no session-level setting can bypass them: hardline catastrophic commands, password-piping to ``sudo -S`` with no SUDO_PASSWORD configured (full guard only), the user's own approvals.deny rules ("never, even under yolo"), and deletion of the Python interpreter/venv this very runtime boots from (a delete the agent cannot walk back — the next start fails before any tool can run, #58748).)command_deletes_runtimez Hardline block: %s (command: %s)rz+Runtime self-delete block: %s (command: %s)zrecursive/any delete of z(Sudo stdin guard block: %s (command: %s)) agent.runtime_self_protectionrrrJrKrrrr)r-rr is_hardline hardline_descruntime_target is_sudo_guesssudo_guess_descs&$ r) _floor_blockr-sF!8!AK9=RV-X%m==,W5NDn^bVcd%(@@P&QSZ[[)@)I&  NNE`dXe f+O< < G $$r+cHV^8dQhR\R\R\R\/#r$r-rrr%r)r(s"r)r*r*Gs*SC-1>Br+c V\WR7'd\V4;'g \4#\V4pVeV#\ 4'd \4#\ V4'd \4#\ V4wrVpV'g \4#\WgWRV R2RRRR7#)zDetect a dangerous command and handle approval (pattern layer only). ``has_host_access``: a Docker sandbox that bind-mounts host paths must not skip approval. Returns ``{"approved": True/False, "message": str or None, ...}``.rrrrrzFAUTO-APPROVED dangerous command in non-interactive non-gateway context)rr=rrrkr2rlr)r rr,rrrrr)r-rrrblockedrrr=s&&&& r)check_dangerous_commandr#Gs %XOO(77IK77#G~~{+G44{-Eg-N*L{ { 0 Q?FZGg  r+rule_keycHV^8dQhR\R\R\R\/#)r$ tool_namer_r$r%r)r(s"r)r*r*as)S#Cimr+c T;'gRV 2pV'g@V R\P!VPR44P4R, 2pRV RV R2p\ RV 2VR V R 2VVR R V R 2RRV R2R7 #)aEscalate an arbitrary tool call to the human-approval gate. Entry point for a plugin ``pre_tool_call`` hook returning ``{"action": "approve", ...}``: it asks the SAME human gate as Tier-2 dangerous shell patterns (session/permanent allowlist, CLI prompt, gateway pending, once/session/always/deny, timeout fail-closed), so the LLM cannot skip it. Cron honors ``approvals.cron_mode``; any OTHER non-interactive context without an approval bridge fails CLOSED. ``rule_key`` controls the ``[a]lways`` allowlist grain; when empty it is ``tool_name`` + a hash of ``reason`` so DISTINCT reasons on the same tool persist independently. Returns the ``check_dangerous_command`` result shape. zPlugin requires approval for :zutf-8:N NzTool 'z' requires approval (rz plugin_rule: (plugin approval rule)zFind an alternative approach.zplugin-escalated tool call 'z(' in non-interactive non-gateway contextTrnzr but no interactive user or gateway is present to approve it. A plugin flagged this action for human confirmation.) rr=rrrkrlrrr)hashlibsha256encode hexdigestr)r&r_r$rr=rks&&$$ r)request_tool_approvalr/asGG;I;GK ['..1C1CG1L"M"W"W"YZ]"^!_`yk!6{m1EG #8*-;9+%=>Rc ?!=i[Hpq"&"+G95f!f  r+cHV^8dQhR\R\R\R\/#rr)r(s"r)r*r*s*++c+S+.2+?C+r+c\WR7'd\V4;'g \4#\VRR7pVeV#^RIHpV!WV4pVeV#\ P!4p\4'gVR8Xd \4#\V4'd \4#\V4wr(rV'g?V 'g7V 'g/\4Fp \W 4p V fKV u# \4#\V4wrp\4pV 'd\VV4'd \4#\!\"WW.VVWWR8HR7 #)zRun all pre-exec security checks and return a single approval decision. Plugins that want to veto or escalate a command do it from ``pre_tool_call``. ``has_host_access``: a Docker sandbox with bind-mounted host paths takes the normal flow.r!T)r)consume_prepared_guardr#r) r-r=rrNr6rrrrr)r rr,ragent.terminal_approval_batchr2rr$rrrrrrrrr _COMMAND_GATE)r-rrrr"r2prepared approval_moderrrrrfrrr=r6s&&&& r)check_all_command_guardsr7s( %XOO(77IK77t4GD%gIH$779M~~%/{+G44{4=>O4P1z *V')C%g3F! *{-Eg-N*L{)+K ;{K@@{ wm3DVT[C[  r+zexecute_code script execution. The script can spawn subprocesses or mutate files without passing through terminal command approval; approval is one-shot for this run.c$V^8dQhR\/#r#r)r(s"r)r*r*s K Kt Kr+c^RIHp\P!4;'dG\P!4;'d*V!4'*;'d\ \ 44RJ#)aWA local session's turn its viewer submitted, with that viewer there to answer: its frozen launch policy is local-interactive, the admission is the viewer's own prompt (not a plugin injection or another producer admission) and a viewer holding ``session:approve`` is attached now, it is not a delegate_task child (sync or async; they inherit the parent's policy), and the turn's approval notifier is registered under the bound session key. The notifier is registered for every session turn, so it only tells side tasks (their own task key, none registered) apart; it does not show anyone is attached."is_delegated_child_process_contextN)agent.delegation_contextr;ris_local_interactive_sessionis_viewer_turn_with_approverrLrr:s r)_is_local_viewer_turnr?sdL  9 9 ; J J@P@m@m@o J J688 J J"#:#<=TIKr+cHV^8dQhR\R\R\R\/#)r$r.rrr%r)r(s"r)r*r*s/FF3F#FFY]Fr+caa Rp\pVR8Xd \4#\WR7'd \4#\P!4p\ 4'gVR8Xd \4#\ 4wrgr\4FDp V P4R8Xd#\RV P,W4RRR 7u#\4u# V'g V 'd\4'd \4#\4p R S R 2p \W4'd \4#^R IHo \!\"WVV.V WgWVR 8HVV 3RlR7 #)a8Approve an execute_code script before its child process is spawned. The script can call ``subprocess``/``os.system``/``ctypes`` directly, none of which pass through ``terminal()`` / ``DANGEROUS_PATTERNS``; in gateway/ask contexts we fail closed by approving the script as a whole. Same dict contract as ``check_all_command_guards``. Documented limitation: a purely local non-interactive non-gateway session returns approved (the terminal auto-approve contract); the hardline floor still blocks catastrophic ``terminal()`` commands the script issues. See #30882. The hardline floor still blocks catastrophic ``terminal()`` commands the script issues; running arbitrary code headlessly without any approval surface is trusted-by-config (set a gateway/ask surface or ``approvals.cron_mode`` to require approval). See #30882. execute_coder r!r#rzyBLOCKED: execute_code runs arbitrary local Python (including subprocess calls that bypass shell-string approval checks). r"r.rzexecute_code <<'PY' z PYrrc<RS!S4 R2#)z**Code:** ```python rUr2)r.rsr)*check_execute_code_guard..s56KD6Q5RRWXr+) r-r=rrNr6rrrrrr)_EXECUTE_CODE_DESCRIPTIONr,r rr$rrrrhrBr{r?rrrrr_EXECUTE_CODE_GATE)r.rrrr=r6rrrrrr6r-rsf&& @r)check_execute_code_guardrHs-!K+K##{$XOO{$779M~~%/{5>K1z$% 88: OQTQ^Q^_')Z`  {&" v*?*A*A{)+K%dV40G;,,{ 3 GR]!] +zw&X  r+cV^8dQh/^\9d \;R&^\9d\\\3,;R&^\9d\\\3,;R&^\9d\\,;R&^\9d\\,;R&^\9d \;R&^\9d\\\3,;R&^\9d\\\ 3,;R&^\9d\\\ 3,;R &^ \9d\\\3,;R &^ \9d\\\3,;R &#) r$rrrrrrrr:rVrPr)__conditional_annotations__rarwr7rXr'rdobject)r(s"r)r*r*s*  ZML4L[ f$sDy/g h'&4S>&i j s3xk p'&c#h&q r! S s v10T#s(^0w F#"tCH~"G r&%c4i%s t,+T#v+&+u ~ 10T#s(^0 r+)FNN>rr"rrtr>r.r/r-)r-r)Fr)rJr dataclassesrr+rloggingos threadingtypingrutilsrr agent.i18nrtoolsrr7rr r r r r rrrtools.approval_detectionrrrrtools.approval_floorsrrrrrtools.approval_gateway_waitrtools.approval_promptrrrtools.approval_smartr getLoggerr~rJgetenvrLockr9rrrXrrrrr:r=r3rArGrMrVrPrRr[rirurzrrrrrrrrrrrrrrrrrrrrrrrrrrrr%r(r, frozensetr8r9r;rBrErIrLr[r^rrrrr _STOP_COMMAND _STOP_ACTIONr4rGrrrrrr rrr#r/r7rFr?rHr*)rJs@r)r_sq " 2" @pp/   8 $*"))4F*KLL $&&% "%&5 .00!# " - 2$&%)++."J"T 6 E #) J q5) * 2,H "/$7C* # -$:/10K :HyV/##ab =>1C[dCk b4 !L $\\\, 'FL  KM@  &2 $$=M  d$5W[SAMQ34 CDmS563mCkQI  4tSW` g qB\Q56 [U#* U%EX]S@<O*+B\Q,- R   @F16FEIFR 9FFRVFF#4FJF FCE Ffh F DI F ik FR"1%U%44"`d<+^i KFTr+