+ lHjaR:t90tRt^RIt^RIt^RIHt^RIHt^RIH t ^RI H t H t H t Ht^RIHtHtHtHt^RIHtHtHt^RItR;tRR 0tRt]^kR tRt]^kR tR R ltR Rlt RRlt!RRlt"RRlt#RRlt$RR2R3llt5R4R5lt6R6R7lt7R8R9lt8R#)?aqWrite-side safety guards for write_file / patch. Every guard returns ``None`` when the write may proceed, else an error string the tool returns verbatim. Guards, in the order the tools apply them: ``_check_sensitive_path`` (hard deny), ``_check_binary_document_write``, ``_check_protected_instruction_write`` (ALWAYS ask), ``_check_approval_required_write`` (normal gate), ``_check_cross_profile_path`` (sandbox-mirror lost-work), ``_is_internal_file_tool_content``. ``_stale_overwrite_blocker`` (write_file only, under the per-path lock) refuses a whole-file overwrite of content this task never saw or that changed since. N)Path)get_nt_namespace_error) file_state)has_binary_extensionhas_opaque_document_extension is_pdf_pathis_sqlite_sidecar) _expand_tilde_resolve_path_for_task_ssh_path_escapes_home_terminal_env_type_for_task)_has_full_write_baseline_is_own_blind_patch_read_mtime_driftedz/var/run/docker.sockz/run/docker.sockFc$V^8dQhR\/#returnstr)formats"B/home/ubuntu/.hermes/hermes-agent/tools/file_tools_write_guards.py __annotate__r6s,,s,cJ^RIHp\V!4P44#)get_config_path)hermes_cli.configrrresolvers r_config_path_resolvedr 6s1  ((* ++rc$V^8dQhR\/#rr)rs"rrr;s4434rch^RIHp\PP \ V!444#)rget_hermes_home)hermes_constantsr$ospathrealpathrr#s r_hermes_home_realr);s"0 77  C 12 33rc2V^8dQhR\R,/#rrNr)rs"rrr@sS4Zrc \'d\#\4# \dU^RIHp\ \\ T!444R, P44u# \dR#i;ii;i)zResolved absolute path of the Hermes config file for the ACTIVE profile. Resolved per call so it tracks the per-turn ``HERMES_HOME`` scope (#107327); a test may pin it via ``_hermes_config_resolved`` + ``_hermes_config_resolved_loaded``.r#z config.yamlN) _hermes_config_resolved_loaded_hermes_config_resolvedr Exceptionr%r$rrrr#s r_get_hermes_config_resolvedr0@sm &%&&$&&    8S!234}DMMOP P   s,  A=/profiles/`` and the root is exempt too.r#N) _real_hermes_home_loaded_real_hermes_home_cachedr)r/r%r$r&r'r(rr#s r_get_real_hermes_homer5Ysd '' ""    877##C(9$:; ;   s,  A32AA3 A/*A3.A//A3c>V^8dQhR\\R3,/#)rr.)tupler)rs"rrrss>>eCHo>rc @\4pV'gR#^RIHpV!V4pVfV3#\P P \\\V44PP44pV'd W08wdW3#V3# \dRpLxi;i)uRealpaths of the Hermes home tree(s) the protected-instruction gate must stay out of: the ACTIVE profile's home, plus the Hermes ROOT when that home is a named profile (``/profiles/``). Exempting only the profile dir left the root's DIRECT files (LEDGER.md / MEMORY.md / SOUL.md / AGENTS.md ...) to the ``.hermes`` component rule, which gated them like a project-local ``/.hermes/config.yaml`` — fail-closed headless (#110630). They are the agent's own store, governed by their own guards, exactly like ``~/.hermes`` under the default profile. The root is added only when the shape really is a named profile (``named_profile_home``), so a coincidental ``profiles/`` dir elsewhere never exempts its parent; the home comes from the ACTIVE scope, never ``HERMES_HOME`` alone.)named_profile_homeN) r5r%r9r/r&r'r(rrparent)homer9 profile_homeroots r_hermes_exempt_homesr?ss ! "D  7)$/ w 77  CS%6 7 > > E EF GDDLD<=tg=  sB BBc<V^8dQhR\R\R\/#rfilepathtask_idrr)rs"rrrs!sSSrc^\\W44# \\3dTu#i;i)zOTask-resolved path string, falling back to the raw input on resolution failure.)rr OSError ValueError)rBrCs&&r_resolved_or_rawrGs1)(<== Z s ,,cJV^8dQhR\R\R\R,/#rrBrCrNr)rs"rrrs%C#cDjrc\VRR7pV'dV#\W4\PP \ V443p\ V^,4'd\V4R8XdRV R2#\;QJdRV4F 'gK RM RM !RV44'dR V R 2#\4pV'd WC9dR V R 2#R #)zHReturn an error message if the path targets a sensitive system location.Write)verbsshzRefusing to write to z: it climbs above the SSH home and the remote home could not be detected, so its target cannot be checked. Pass an absolute path.c3l"TF*qP\4;'g V\9xK, R#5iN) startswith_SENSITIVE_PATH_PREFIXES_SENSITIVE_EXACT_PATHS).0cs& r (_check_sensitive_path..s, eZdUV<<0 1 P PQ:P5P PZds44TFz,Refusing to write to sensitive system path: zD Use the terminal tool with sudo if you need to modify system files.z)Refusing to write to Hermes config file: zz Agent cannot modify security-sensitive configuration. Edit ~/.hermes/config.yaml directly or use 'hermes config' instead.N) rrGr&r'normpathr r r anyr0)rBrCnt_err candidates hermes_configs&& r_check_sensitive_pathr\s$H7 ;F  "85rww7G7G V^H_7`aJjm,,1LW1UY^1^#H:.b b c s eZd esss eZd eee:8*ER R S 01M47zBR R S rc\V^8dQhR\\\\,3,/#r)r7boollistr)rs"rrrs 11uT49_'=1rc0^RIHpHpV!4pV!VRRRR7pV!VRR.R7p\ T\ 4'gRp\ T\ 4'g.pY4Uu.uFqU'gK \T4NK up3# \dR.3u#i;iuupi)uReturn ``(enabled, extra_patterns)`` from ``security.protected_instruction_files`` / ``security.protected_instruction_extra_patterns`` (fnmatch on basename). Config read failures keep the gate ON — fail-safe for a security boundary.) load_configcfg_getsecurityprotected_instruction_filesTdefault$protected_instruction_extra_patterns)rrarbr/ isinstancer^r_r)rarbcfgenabledextraps r_protected_instruction_configrms:m#z+HRVWZ)OY[\ gt $ $ eT " " U0UaVSVU0 00 Rx 1s'A> B+B>BBrjextra_patternsc V^8dQhR\R\R\R,R\\,R,R\R,/#)rrBrCrjNrnr)rr^r_)rs"rrrsD**C*#*.2Tk*26s)d2B*NQTXj*rca VeVf \4wr#V'gR#\PP\ V44p\PP \ \W444p\4F8pWV8Xg/VPV\P,4'gK7R# WE3Fp\PPV4pVP4o S \ 9gA\";QJdV 3RlV4F 'gK RM RM!V 3RlV44'dVu#VP%RR4P'R4P)R4p \+V 4^8gKV R,R8XgKVu# R# \\\3d$\PP T4pEL\i;i) aReturn a short label when ``filepath`` targets a protected instruction file, else ``None``. Matches BOTH the normalized input and its realpath so no symlink direction escapes. Matching runs on BOTH the normalized input path and its realpath so neither a symlink pointing AT a protected file (#41351) nor a protected name that is itself a symlink escapes the gate. ``..`` traversal is neutralized by normpath/realpath before the basename compare. Nc3n<"TF*p\P!SVP44xK, R#5irO)fnmatchlower)rSpattern base_lowers& rrU0_protected_instruction_reason..s*A\LZ GMMO<x(Q$RS*+  H$7$7 BFF8J$K$K,!+ ww *ZZ\ 9 9SSA\LZA\SSSA\LZA\>\>\K!!$,33C8>>sC u:?uRyI5 , 1 Z .077##J/0s 1F5GGzz7BLOCKED: write to protected agent-instruction file(s) (z) {why} The user has NOT consented to this write. Do NOT retry it or attempt the same edit via another path (terminal, execute_code, etc.).zJapproval prompt timed out without a user response. Silence is not consent.whyzwas denied by the user.N)_fire_approval_hookget_current_session_key)_await_gateway_decision)prompt_dangerous_approvalcommand pattern_keyprotected_instruction_file pattern_keys descriptionallow_permanentF allow_sessiongateway)surface notify_failedzBrequires approval but the approval request could not be delivered. cancelledz1approval was withdrawn before the user answered (z).choicer)_get_approval_callback)_no_user_can_answercli)rrrr session_keyr)rrapproval_callbackzoncealwayssession)joindictfromkeysrtools.approvalapprovaltools.approval_contextrrtools.approval_gateway_waitrtools.approval_promptrr/_APPROVAL_UNAVAILABLE_lock_gateway_notify_cbsgettools.terminal_toolr _NO_HUMANrgetattr)rrCtargetsrdisplayblocked timed_outdenied _approvalrrrrr notify_cb approval_datadecisionrtimedrcallbackr hook_kwargss&& r'_request_protected_instruction_approvalrsii g./G 8 B3 37)1%G A'K  #opI ^^ 9^ :F9*WGC *+K ___!5599+FI  w 7 9: ; u U $ +;=Zcd << ( (>>&j>k k << $ $>>(YZbcnZoYppr&s>t t X.HLL4L0L  B-/H  >>i>0 0 ?  >>i>0 07Qm)E(FT_inp BkB* %u`hjS SFS [ >>'**1&';*O)PPR'T>U U)# V<<9)6)s 9~~"7~889__  , H sTH%>I I .I  I4%!I I  I I I I10I14 JJc`V^8dQhR\\,R\R\R,/#rpathsrCrNr)rs"rrrZs1 E Ed3i E# EVY\`V` Ercaaa\4wooS'gR#VVV3RlV4Uu.uFpV'gK VNK ppV'gR#\VS4#uupi)zGate a write/patch touching protected instruction files. ONE protected file gates the ENTIRE multi-file patch (one prompt, all-or-nothing).Nc3B<"TFp\VSSSR7xK R#5i))rjrnN)r)rSrlrjrkrCs& rrU5_check_protected_instruction_write..`s'+$)q9GWejkk$)s)rmr)rrCrrrjrks&f @@r"_check_protected_instruction_writerZs_34NGU +$)+1+Q./q+G1  27G DD 1s AAc`V^8dQhR\\,R\R\R,/#rr)rs"rrrgs1-F-F$s)-Fc-FRUX\R\-Frc ^RIHpTUu.uFq2!\Y144'gKTNK ppT'gR#RP \ P T44pRT R2pRT R2p^RIHpTPR TR T R 2TPR R7TPR R7R RTP\R7R7p T PR4'dR#T PR4;'gTPRR7# \dR#i;iuupi \dTP\R7u#i;i)zGate a write/patch touching an approval-required path (``~/.ssh/config`` can steer execution via ``ProxyCommand``). Routine gate: once/session/always, honors --yolo, fail-closed without an interactive/gateway channel.)is_write_approval_requiredNrz$Write to SSH client config file(s): zs. The SSH config can carry ProxyCommand / Match exec directives that run commands, so writes require your approval.z&BLOCKED: write to SSH config file(s) (zf) {why} Do NOT retry it via another path (terminal, execute_code) without the user's explicit consent.rssh_config_writerrz2requires approval but this cron session denies it.zrequires approval but single-query (-q) sessions run without a user present to approve it. To allow flagged actions in single-query mode, set approvals.single_query_mode: approve in config.yaml.T)rrdisplay_targetcron_deny_messagesingle_query_deny_messageautoapprove_log_prefixfail_closed_when_no_humanno_human_block_messageapprovedmessagez was denied.)agent.file_safetyrr/rGrrrrrrr_run_approval_gaterr) rrCrrlrdisplay_targetsrrrresults && r_check_approval_required_writergs_@  \%Q#=>Nq>Z#[qq%G\ ii g 67O ..?@9 9 10AB/ / 9* ) )&#O#4A6!..-a.b")..*#1#+ 2"&&~~)~<* >Fzz* ::i E EGNN}N$EEO  ] 9~~"7~889s-DDD,D DD!EEc>V^8dQhR\R\R,/#)rrCrNr)rs"rrrs3sTzrc^RIHpHpHpHpV!V4pT;_uu_4VP V4;'gVP V4pRRR4XeDVP PR8H;'d\\VRR44pV'dR#R#V!4pTP R4R8XdTP R R 4'dR#R# +'giL;i \dR#i;i) zPReturn the container-side Hermes mirror prefix for persistent Docker file tools.)_active_environments _env_lock_get_env_config_resolve_container_task_idNDockerEnvironment _persistentFz /root/.hermesenv_typedockercontainer_persistentT) rrrrrr __class____name__r^rr/) rCrrrr container_keyenvpersistent_dockerconfigs & r%_get_container_mirror_prefix_for_taskrs  Z Z27; Y&**=9^^=Q=U=UV]=^C ?!$!7!7;N!N"N"N%)'#}e*L%M &7? AT A "zz*)fjj9OQU.V.V Y s@C&+C +C&7C&C&C&C& C# C&& C54C5cJV^8dQhR\R\R\R,/#rIr)rs"rrrs+ p p pc p#PT* prc^RIHpHp\ Y4pT!T4pTeT#T!T\ T4R7# \dR#i;i)uSoft-guard: warn when ``filepath`` lands on a host-side or Docker sandbox MIRROR of Hermes state (a write the host never reads). Not profile isolation — that guard was removed; ``cross_profile=True`` keeps bypassing this one for replay compat. Fails open.)get_container_mirror_warningget_sandbox_mirror_warningN) mirror_prefix)rrrr/rGr)rBrCrrrwarnings&& r_check_cross_profile_pathrsS^ 2H(2G '@efm@n oo s6 AAc<V^8dQhR\R\R\/#rAr)rs"rrrs!&&&s&3&rc^RIHpHp\\ W44pV!V4pT!T4'd6Tf \ T4MTp\T4P4'dR#R#TPTPT;'gT44wrxTR9dR#TR9dR#R# \ dRpLi;i \ dR#i;i \dR#i;i \ dR#i;i)u<Is a REGULAR file at *filepath* present where the write will execute (the task's backend, not the controller's disk — #122662)? Returns ``"exists"``, ``"absent"`` or ``"unavailable"``. Host-backed envs keep ``Path.is_file`` semantics; anything not proven absent is ``"unavailable"`` and callers must fail closed. )_file_ops_uses_host_paths _get_file_opsN unavailableexistsabsent)okbad_size)missing not_regular) tools.file_toolsrrrr r/r ris_filerE_probe_regular_file _expand_path) rBrCrrrfile_opsprobe_sizestatuss && r_target_regular_file_staters J-h@A )!**,4+; h' #E{22448 B( B!44X5J5J8K_K_W_5`a ## ++ 7     sRB+B> C(C+C" C"+ B;:B;> C  C  CC" C10C1cJV^8dQhR\R\R\R,/#rIr)rs"rrrs+@@3@@SSWZ@rc\PPV4^,P4p\ V4'd RV RV R2#\ V4'd RV RV R2#\ V4pV'g\V4'd7\W4pVR8XdV'dRV R2#R V RV R 2#VR 8XdR V R 2#R#)uReject text-tool writes that would corrupt a binary document (read_file showed EXTRACTED text, so the model may write it back). Opaque document formats and SQLite sidecars (-wal/-shm/-journal) are always rejected; .pdf and every other BINARY_EXTENSIONS suffix only when OVERWRITING an existing file (raw PDF syntax is text-authorable and text fixtures named ``*.db`` exist). "Existing" is asked of the filesystem the write will hit — the task's backend, via ``_target_regular_file_state`` — never the controller's disk alone (#122662). ``read_file`` auto-extracts .docx/.xlsx/.pptx (and PDF, via anydoc) to readable text, so the model plausibly believes it holds the file's contents and tries to write the edited text back with write_file/patch. A plain-text write can never produce a valid OOXML/OLE/ODF container, so that write silently destroys the document (port of nearai/ironclaw#7109). z1Refusing to write plain text to binary document 'z' (a). A text write cannot produce a valid document container and would corrupt the file (read_file showed you EXTRACTED text, not the real bytes). Use the docx/xlsx/powerpoint skills or a library like python-docx/openpyxl/python-pptx via the terminal to create or edit this document.z7Refusing to write plain text to binary SQLite sidecar 'z). A -wal/-shm/-journal file holds raw database pages that SQLite reads on the next open; text there corrupts the database. Use the sqlite3 CLI or a SQLite library via the terminal to modify the database instead.rz$Refusing to overwrite existing PDF 'u' with plain text. read_file showed you EXTRACTED text, not the real bytes — writing text back would destroy the document. Use the pdf skill or a PDF library via the terminal to modify it. (Creating a NEW .pdf file is allowed.)z,Refusing to overwrite existing binary file 'u1) with plain text — read_file showed you extracted or mojibake text, not the real bytes, and writing text back would destroy the file. Use a binary-aware tool via the terminal to modify it (for SQLite databases, the sqlite3 CLI or a SQLite library). (Creating a NEW file with this extension is allowed.)rzRefusing to write to 'u': could not establish whether the target file already exists where this write would execute (the terminal environment may be starting, unreachable, or was removed). The file was NOT modified — retry once the environment is reachable.N) r&r'splitextrsrrrrr)rBrCextpdfstates&& r_check_binary_document_writers  ''  8 $Q ' - - /C$X..?zSER  ""EhZsSVRWX   ! h C "8,,*8= H :8*E##$?xjC5QHH I M !) 3   ! ruFile unchanged since last read. The content from the earlier read_file result in this conversation is still current — refer to that instead of re-reading.c dV^8dQhR\R\R,R\R\R,/#)rrBrNrCrr)rs"rrr-s3%%s%cDj%3%SVY]S]%rc\P!4'dR#V'd\P!W!4MRpV'dV#\W4'dV R2#V'd\ W4'dR#\ V4P 4pT'gR#\Y4'dR#T R2# \dR#i;i)a&Reason write_file must NOT replace the existing file, else ``None``. Refuses BEFORE any disk mutation (the pre-#65604 warning arrived after the clobber): a sibling/external/partial-read staleness finding, or an existing file with no full-content baseline for this task (never read in full, read redacted, only patched without one). Net-new files, files this task fully read (in one page or by paging contiguously to the last line), wrote, or patched from such a baseline, unresolvable paths and the file-state kill switch all let the write proceed. Nzj was modified since you last read it (external edit or concurrent agent). Re-read the file before writing.zYour patch changed this file without a full view of its current content. Read the current file in full before a whole-file overwrite, or continue with targeted patches.u7 exists but this task has not seen its full current content (never read, patched without a prior full read, or only a redacted/partial view). Read the file — every page of it, if it needs offset/limit — or use patch for a targeted edit; a stale conversation copy must not overwrite the current disk content.) rguard_disabled check_stalerr rrrEr)rBrrCstalers&&& r_stale_overwrite_blockerr-s  ""9AJ " "7 5tE  8--jB B C /BBh&&( 8-- X Y *  s:B66 CCcVV^8dQhR\R\R\R,R\/#)rrBreasonrNr)rr)rs"rrrUs-3sTzUYrc<RRV RV R2RRRV/pV'dW#R&V#) zpModel-facing refusal payload for write_file; ``stale_write_blocked`` lets callers tell it apart from I/O errors.errorzRefusing to overwrite z: z The file was NOT modified. Reload the current contents with read_file (every page, for a file that needs offset/limit), merge the requested change, then call write_file again. For small edits, prefer patch so existing unrelated changes are preserved.stale_write_blockedTr' resolved_pathr:)rBrrrs&&& r_stale_write_refusalr#UsC $XJb98 8 t F"* Mrc0V^8dQhR\R\/#rcontentrrr^)rs"rrrgs>>3>4>rc\V\4'gR#VP4p\V4;'d4\V9;'d#\ V4^\ \4,8*#)uTrue when content is the read_file dedup status message, verbatim or lightly framed (contains the full message and is <=2x its length — a real file quoting it would be longer).F)rhrstripr^_READ_DEDUP_STATUS_MESSAGEr)r&strippeds& r_is_internal_file_status_textr,gs^ gs # #}}H > > >8HD > > H S!;<<<>rc0V^8dQhR\R\/#r%r')rs"rrrqs2222rcx\V\4'gR#VP4Uu.uFqP4'gKVNK pp\ V4^8dR#.pVFapVP 4P R4wrEpV'gK/VP4'gKGVP\V44Kc \ V4^8g!\ V4\ V4, R8dR#\R\P!V444pV\ V4^, 8#uupi)zTrue for content dominated by read_file's ``LINE_NUM|CONTENT`` display (>=60% of non-empty lines are consecutive numbered lines; a lone ``1|value`` is allowed).F|g333333?c3H"TFwrW!^,8XgK^xK R#5i)Nr:)rSprevcurrents& rrU>_looks_like_read_file_line_numbered_content..s"g3O-$SZef^fSfAA3Os" ") rhr splitlinesr)rlstrip partitionisdigitappendintsum itertoolspairwise)r&linelinesnumberedprefixr{_restconsecutive_pairss& r+_looks_like_read_file_line_numbered_contentrDqs gs # #%002 C2djjlTT2E C 5zA~H![[]44S9U 36>>## OOCK ( 8}qCMCJ6<g93E3Eh3Ogg H  1 11 Ds D7D7c0V^8dQhR\R\/#r%r')rs"rrrsjjCjDjrc>\V4;'g \V4#)zLReturn True when content is file-tool display text, not intended file bytes.)r,rD)r&s&r_is_internal_file_tool_contentrGs ( 1 i i5`ah5iircV^8dQh/^\9d\R,;R&^\9d\R,;R&#)rNr.r4)__conditional_annotations__r)rs"rrrs<  ^+*t*_ b,+#*+c r)z/etc/z/boot/z/usr/lib/systemd/z /private/etc/z/private/var/db/z/private/var/root/re>soul.md agents.md claude.md .cursorrulesrO):rI__doc__rrr&pathlibrrrtoolsrtools.binary_extensionsrrrrtools.file_tools_pathsr r r r tools.file_tools_read_trackingr rrr<rQrRr.r-r4r3r r)r0r5r?rGr\ frozensetr}rmrrrrrrrrrrr*rr#r,rDrGr)rIs@rrUs&  4 ``mm .12DE'+*!&'++ , 4 24>0T$-.9$: 1$*<@*EI**ZW \ S*l E-F`( p&R@J= %P$>2&jr