+ lHj%Rt^RIt^RIt^RIt^RIt^RIt^RIt^RIHt ^RI H t H t H t ]P!R4tRRltRRltR R ltR tRR R lltRRlt]!R4t]P0!R4tRRltRRltR#)aPre-gate floors for :mod:`tools.approval`: decisions that never reach a prompt. Unconditional blocks (hardline, ``sudo -S`` password piping, the user's own ``approvals.deny`` globs) and the permanent command allowlist match. All of them run BEFORE yolo / ``approvals.mode: off`` / cron approve-mode; the allowlist runs after. Session state stays in ``tools.approval`` and is read through it at call time. N)approval_context)_MALFORMED_EXEC_DESCRIPTION_PARSER_LIMIT_DESCRIPTION_deny_command_variantsztools.approvalc>V^8dQhR\R\R,/#commandreturnNstr)formats":/home/ubuntu/.hermes/hermes-agent/tools/approval_floors.py __annotate__rs33:c\P!4PR4;'g.pTUu.uFCp\ T\ 4'gKTP 4'gK3TP 4NKE ppT'gR#\T4FZpTP4P 4pTF3p\P!YVP44'gK/Tuu# K\ R# \dR#i;iuupi)uReturn the matching ``approvals.deny`` glob, or None. User-defined fnmatch globs that block unconditionally — like the hardline floor, a match fires BEFORE the yolo / mode=off bypass ("never let the agent run this, even under yolo"). Case-insensitive, run over the same normalized/deobfuscated variants the dangerous-pattern detector uses so quoting tricks (``r\m``, ``git st""atus``) can't sidestep a rule.denyN) _ctx_get_approval_configget Exception isinstancer striprlowerfnmatch fnmatchcase)r deny_patternspglobscommand_variant candidatepatterns& r_match_user_deny_ruler"s11377?EE2 !. R 1As1CY YQWWY E R 1':#))+113 G""9mmo>>;   Rs'*C4C4DD)D4 DDc0V^8dQhR\R\/#)rr!r r dict)r s"rrr-smmSmTmrcRRRRRRV R2/#)z@Build the standard block result for an ``approvals.deny`` match.approvedF user_denyTmessagez:BLOCKED: this command matches the user-defined deny rule 'u' (approvals.deny in config.yaml). It cannot be executed via the agent — not even with --yolo, /yolo, or approvals.mode=off. Do NOT retry or rephrase this command; the user has explicitly forbidden it.)r!s&r_user_deny_block_resultr+-s/ {D) 9k k mmrc>V^8dQhR\R\R,/#rr )r s"rrr6s##3#3:#rc,^RIHpV!4R, R, pVPRRR7\P!4R, pVP R4F]p\ P !\4;_uu_4VP4PV8dVP4RRR4K_ VR\\P!44 R \P!4PR , R 2, pTPR V R 2V,VP!R 4'dRMR ,RRR7\#V4# +'giEK ;i \$d\&P)RRR7R#i;i)uPersist a parser-limit-blocked command as a runnable script. That block fires on payload SIZE/shape, not the operation — usually a legitimate script the model inlined. Saving it makes recovery one turn (`bash `) instead of two, and is strictly safer than the hint-only path: the file goes through the normal execution pipeline (including the referenced-script content guard) and nothing runs here. Returns the path, or None on any failure (hint falls back to write_file).)get_hermes_homecachezblocked-scriptsT)parentsexist_okz blocked-*.shNzblocked--:NNz.shz#!/usr/bin/env bash # Auto-saved by Hermes: this command exceeded the inline command # parser limit and was blocked from direct execution. Review it, # then run it via: bash  zutf-8replace)encodingerrorszfailed to save blocked payload)exc_infoi: )hermes_constantsr.mkdirtimeglob contextlibsuppressOSErrorstatst_mtimeunlinkintuuiduuid4hex write_textendswithr rloggerdebug)r r. script_dircutoffoldpaths& r_save_blocked_payloadrP6sT4$&03DD 5y(??>2C$$W--88:&&/JJL.-3hs499;'7&8$**,:J:J2:N9OsSS  '(,fB 03: :DKCSCSTXCYCYR_c eY  4y#.--$  5 Es+BE-0E2B%E- E* # E--"FFz RECOVERY: this block fires on oversized/unparseable inline command payloads (heredocs, giant one-liners), not on the operation itself. c<V^8dQhR\R\R\/#)r descriptionr r r$)r s"rrrbs&EEEcE4ErcRV R2pV\\39dNV'd \V4MRpV'dV\RV RV R2,, pMV\R,, pRR R R R V/#) z5Build the standard block result for a hardline match.zBLOCKED (hardline): u. This command is on the unconditional blocklist and cannot be executed via the agent — not even with --yolo, /yolo, approvals.mode=off, or cron approve mode. If you genuinely need to run it, run it yourself in a terminal outside the agent.NzYour command was saved to u1 — review it, then run: terminal(command="bash z"). Do not retry inline.zWrite the script to a file with write_file, then run it: terminal(command="bash /path/script.sh") or "python3 /path/script.py". Do not retry inline.r'FhardlineTr))rrrP_RECOVERY_PREFIX)rRr r)saveds&& r_hardline_block_resultrWbs {m,K K 02MNN29%g.t  ',UG3efkelm'' G 'D G z4G DDrc0V^8dQhR\R\/#)rrRr r$)r s"rrr}sbb#b$brcRRRRV R2/#)z5Build the standard block result for sudo stdin guard.r'Fr)z BLOCKED: u. Do not pipe passwords to 'sudo -S' — this is a brute-force attack vector. Set SUDO_PASSWORD in your .env file if the agent needs passwordless sudo, or run the sudo command manually in your own terminal.r*)rRs&r_sudo_stdin_block_resultrZ}s( y K=!` ` bbrz ;&|<>`$()z:(?:^|[ \t])(?:-[^-\s]*[ce]|--(?:command|eval))(?:[= \t]|$)c0V^8dQhR\R\/#rr r r bool)r s"rrrs)T)T3)T4)Trc>T;'gRpRpRp^p\V4pW48dW,pVR8Xd?VR8wd8V^,V8dW^,,MRpV\9dRpV^, pKSVe(WQ8XdRpMhVR8Xd VR 9dR#V\9dRpMJVR 9dTpM@VR8Xd&V^,V8dW^,,R 8XdR#MV\9d VR 9dR#V^, pKVeR#T;'d\\P V44#) aReturn True when a command is too compound for the allowlist shortcut. Quote-aware: metacharacters inside quotes or behind a backslash are literal arguments (``cargo bench -- '^a(b|c)$'``), not shell syntax. Still disqualifying: ``$`` or backtick inside DOUBLE quotes (expansion stays active), and any quoted/escaped control character when the command also carries a ``-c``/``-e``/``--command``/``--eval``-style option that would hand the quoted text to another interpreter.r5NF\'T"$(z())`rc)rarb)len_SHELL_CONTROL_CHARSr^_REINTERPRETED_ARGUMENT_REsearch)r quotehas_reinterpretableinchnxts& r_has_allowlist_shell_operatorrpsmmG E A G A % Z :%3,$%EAI'a%.2C**&*# FA   {#" "2++&*# : E 3Y1uqyWU^s2 ' 'BdN Q   S S4(B(I(I'(R#SSrc0V^8dQhR\R\/#r\r])r s"rrrs#$rcXa^RIHpT;'gRP4pV'd\V4'dR#VP;_uu_4\ VP 44pRRR4XFo\S\4'dSP4MRoS'gK5VS8Xgb\;QJdV3RlR4F 'gK RM RM!V3RlR44'gK~\P!VS4'gKR# R# +'giL;i)aTrue when command_allowlist holds this exact command text or a matching glob. Permanent approvals historically store dangerous-pattern keys such as ``recursive delete``; manual entries are command text, possibly with shell-style wildcards like ``podman *``.)approvalr5FNc3,<"TF qS9xK R#5i)Nr*).0rnr!s& r 7_command_matches_permanent_allowlist..s2Q5R=5sz*?[T) toolsrsrrp_locktuple_permanent_setrr anyrr)r _apatternsr!s& @r$_command_matches_permanent_allowlistrs %}}"##%G 3G<< **,- %/%=%='--/2 77*ss2Q52Qsss2Q52Q/Q/Q3:3F3FwPW3X3X   s D D) )r5)__doc__r>rloggingrer<rErxrrtools.approval_detectionrrr getLoggerrJr"r+rPrUrWrZ frozensetrgcompilerhrprr*rrrs *TT   + ,,m#NS E6b!1ZZ(ef)TXr