+ lHj(a0t$Rt^RIHt^RIt^RIt^RIHt^RIH t H t ^RI H t ^RI HtHtHtHt]P$!]4t] !RRR7tR ]R &R R R RRRR^RRRRRRRRRRRRRR/ tR]R&!RR]4t!RR ]]]3,4tR!R"ltR#R$ltR%R&ltR'R(lt R8R)R*llt!R+R,lt"R-R.lt#R/R/R0R1llt$R2R3lt%R/R/R4R5llt&]R6R7l4t'R#)9ahPer-turn terminal scope: profile-scoped TERMINAL_* policy. Multiplexed surfaces (gateway, dashboard/TUI, cron) serve several profiles from one process; mirroring terminal settings into ``os.environ`` let the first profile pin its backend onto everyone else (sandbox escape). Like ``agent/secret_scope.py``, a ContextVar holds the active profile's COMPLETE ``TERMINAL_*`` policy; while bound, ``terminal_env`` resolves ONLY from it (omitted keys -> defined default, never ambient env). If the policy cannot be resolved a *refusal* scope is installed and terminal execution raises :class:`TerminalPolicyUnavailable`. ) annotationsN)contextmanager) ContextVarToken)Path)AnyDictIteratorOptionalhermes_terminal_scope)defaultr_terminal_scope_varcwd.ssh_hostssh_userssh_portssh_keydocker_orphan_reaperTdocker_persist_across_processes sandbox_dirlifetime_secondsi,docker_shared_container_key home_modeautodict[str, Any]_TOOL_LEVEL_DEFAULTSc]tRt^#tRtRtR#)TerminalPolicyUnavailablezOThe routed profile's ``.env``/``config.yaml`` exists but cannot be read/parsed.N)__name__ __module__ __qualname____firstlineno____doc____static_attributes__r 9/home/ubuntu/.hermes/hermes-agent/tools/terminal_scope.pyrr#sYr'rc2a]tRt^'tRtRV3RlltRtV;t#)TerminalPolicyRefusalzKMarker scope (empty dict subclass) installed when policy resolution failed.c V^8dQhRRRR/#)reasonstrreturnNoner )formats"r( __annotate__"TerminalPolicyRefusal.__annotate__*sstr'c 0<\SV`4WnR#N)super__init__r-)selfr- __class__s&&r(r7TerminalPolicyRefusal.__init__*s  r')r-)r!r"r#r$r%r7r& __classcell__)r9s@r(r*r*'sUr'r*c V^8dQhRRRR/#)r,mappingOptional[dict[str, str]]r/rr )r1s"r(r2r2/s,, 8,U,r'c,\PV4#)z;Install *mapping* as the current context's terminal policy.)r set)r=s&r(set_terminal_scoperA/s  " "7 ++r'c V^8dQhRRRR/#)r,tokenrr/r0r )r1s"r(r2r24s%%%$%r'c0\PV4R#r5)r reset)rCs&r(reset_terminal_scoperF4se$r'cV^8dQhRR/#)r,r/r>r )r1s"r(r2r28s%%4%r'c*\P4#)zEThe active scope mapping/refusal, or ``None`` when no scope is bound.)r getr r'r(get_terminal_scoperJ8s  " " $$r'cV^8dQhRR/#)r,r/r0r )r1s"r(r2r2=s M MD Mr'c\P4p\V\4'd\ RVP 24hR#)aRaise when the active scope is a refusal scope (fail closed). Execution paths (terminal tool, execute_code) call this before spawning anything: under a refusal scope the profile's terminal policy could not be resolved, and running with the launch process's ambient policy is exactly the authority leak this module closes (#68559 requires refusal, not fallback). Non-scoped and policy-scoped contexts pass silently. z.terminal policy unavailable for this profile: N)r rI isinstancer*rr-)scopes r(enforce_no_refusalrO=sB # # %E%.//' 8N 8t 8r'c^RIHpHpVP4FUwrEVe&VR8Xd!\ V4P 4R9dK0VP V4pV'gKKV!V4W&KW R#))TERMINAL_CONFIG_ENV_MAP_terminal_env_valueNr>rrr)hermes_cli.configr[r\itemsr.striprI)rNr=r[r\cfg_keyrUenv_vars&& r(_apply_terminal_mappingrbYs^N!--/ =W-#e*2B2B2DH\2\ )--g6 717EN*r'cV^8dQhRR/#)r,r/rXr )r1s"r(r2r2hsr'cp^RIHp/p\T/\CVP R4;'g/C4V#)zCode-default ``TERMINAL_*`` policy: what a profile-bypassing session freezes instead of reading ``.env``/``config.yaml``. Total like the profile projection, minus the profile.)DEFAULT_CONFIGterminal)hermes_cli.config_defaultsrerbrrI)rerNs r(default_terminal_scoperhhs<:EE#e&:#e~?Q?QR\?]?c?cac#ef Lr' env_overlayc$V^8dQhRRRRRR/#)r, hermes_homerrir>r/rXr )r1s"r(r2r2rs)AAA&>AJXAr'c\V4p\4pVPR4pVR, pVP4'dLVP 4^RIHpT!T4pTPRTP444RT9p MRp V'dAVPR VP444VPR4RV39dR p VR , p V P4p T 'di^R I H p T !T 4p \T \4'dT PR4MRp\T\4'd\Y>4T ;'gRT9p T 'dRMRTR&\!T4T# \ dp\ RT RT 24ThRp?ii;i \ dp\ R T RT 24ThRp?ii;i \ dp\ RT RT 24ThRp?ii;i)uPBuild the COMPLETE effective ``TERMINAL_*`` policy for a profile home. Projection: ``DEFAULT_CONFIG['terminal']`` <- profile ``.env`` TERMINAL_* <- *env_overlay* <- profile ``config.yaml`` ``terminal:``. Total by construction, so a bound scope never widens back to ambient authority. Raises :class:`TerminalPolicyUnavailable` if a present file is unreadable. *env_overlay* is a TRUSTED ``TERMINAL_*`` mapping captured from the launch process before multiplexing began (``tui_gateway/launch_profile_policy.py``): the launch profile's env-only policy (``TERMINAL_ENV=ssh`` from systemd, ``op run``, a launcher bridge) has no file to rebuild it from, and reading live ``os.environ`` here is the leak this module closes. It sits where the process env sits in the standalone bridge — explicit YAML keys still win (``apply_terminal_config_to_env``). TERMINAL_DOCKER_IMAGEz.envz cannot read z: N) load_env_filec3r"TF-wrVPR4'gKV\V43xK/ R#5i) TERMINAL_N startswithr..0kvs& r( /build_profile_terminal_scope..s*^-@TQALLQ\D][aQ[-@s77Fc3"TF6wrVPR4'gKVR8wgK'V\V43xK8 R#5i)rpTERMINAL_DOCKER_IMAGE_PINNEDNrqrss& r(rwrxs>[-@TQ [1!67;Y6Y!aQ[-@sAAATz config.yamlz"cannot resolve terminal config in )load_yaml_file_readonlyz cannot parse rf docker_image10rz)rrhrIexists read_bytes Exceptionragent.secret_scopernupdater^utilsr{rMdictrb_resolve_scope_cwd_placeholder)rkrihomerN default_imageenv_pathexcrn profile_env image_pinned config_path config_existsr{raw raw_terminals&$ r(build_profile_terminal_scoperrs  D " $EII56Mf}H W    ! 5#H-  ^[->->-@^^/+=   [[->->-@[ [ ??2 3D-;P PL&Ke#**, 1 [)+6C/9d.C.Cswwz* lD ) ) #E 8'II>\+IL3?CSE ()"5) LQ W+l8*Bse,LMSV V W0 e'*LTFRTUXTY(Z[adde [+mK=3%,PQWZ Z [sHF%F&G  F# FF#& G1GG G-G((G-c V^8dQhRRRR/#)r,rNrXr/r0r )r1s"r(r2r2s)).)T)r'c 0VPR4'dR#^RIHpV!RVPRR4RVPRR4P4P 4R 9\ \ P!44R7pV'dW R&R#R#) uGive a scope with no explicit ``terminal.cwd`` the same resolved ``TERMINAL_CWD`` a standalone gateway computes at import (``gateway/run.py``: local backend → ``$HOME``; docker with the workspace mount → the host cwd signal; other backends → unset). Without it a routed turn's ``resolve_agent_cwd()`` falls back to the multiplexer PROCESS cwd (wherever ``hermes gateway`` was launched), so the system prompt, context-file discovery and the local terminal all run in a directory the profile's standalone gateway would never have used. TERMINAL_CWDN) resolve_placeholder_terminal_cwdr TERMINAL_ENV&TERMINAL_DOCKER_MOUNT_CWD_TO_WORKSPACEfalse)configured_cwdterminal_backend messaging_cwddocker_mount_cwd_to_workspace home_fallback>r}yestrue)rIgateway.cwd_placeholderrr_lowerr.rr)rNrresolveds& r(rrs} yy  H/EIInb,I&+ii 4g'??DuwuuwRf'g$))+& H (nr'c$V^8dQhRRRRRR/#)r,rkrrir>r/rr )r1s"r(r2r2s)HHH&>HJOHr'c\\WR74# \dHp\P RT4\ P \\T444uRp?#Rp?ii;i)zYBuild AND install a profile's policy; on failure install the refusal scope. Never raises.)rizterminal policy unavailable: %sN) rArrloggerwarningr r@r*r.)rkrirs&$ r(install_profile_terminal_scopersUH!">{"dee $H8#>"&&'rs # %)00   8 $#--Dd"SZS  3 B B B 2D"CT2)30Mr (nZ ZDcN, %% M 4 8AAEAH),HAEH$$r'