+ lHj'ARt^RIt^RIt^RIt^RIt^RIt^RIHt^RIH t H t ^RI H t ]P!R4t]!R4tRRltR R ltR,R R lltR Rlt]P*!R]P,]P.,4t]P*!R4t]P*!R4tRRlt];QJd.RR-4FNK 5M !RR-44t]P<R3RR3RR33tRRlt RRlt!]P*!R4t"]P*!R4t#R.t$R R!lt%R"R#lt&R$R%lt'R&R'lt(R(R)lt)R*R+lt*R#)/aPre-execution guards for the terminal tool. Pure functions that decide whether a command may run at all: workdir validation, the foreground long-lived/background-operator guidance, the supervised-gateway lifecycle block, and the Windows self-repo git guard. Each ``*_block`` helper returns a finished JSON error string, or None when the command may proceed. Split out of tools/terminal_tool.py; the origin module re-imports every public helper so ``tools.terminal_tool.`` keeps resolving. N)Path)AnyOptional)strip_inert_heredoc_bodiesztools.terminal_toolz /\:_-.~ +@=,c0V^8dQhR\R\/#)chreturnstrbool)formats"?/home/ubuntu/.hermes/hermes-agent/tools/terminal_tool_guards.py __annotate__r s;;c;d;cV'd!\V4^ 8g\V4^8XdR#VP4;'g V\9#) F)ordisalnum_WORKDIR_SAFE_ASCII_CHARS)rs&r_is_safe_workdir_charr s6 R2RC ::< : :2!:::rc>V^8dQhR\R\R,/#)rworkdirr Nr )r s"rrr&s  s sTz rc`T;'gRFp\V4'dKRV: R2u# R#)zError message if *workdir* has a disallowed character, else None. Allowlist rather than deny-list so novel metacharacters can't slip through.z/Blocked: workdir contains disallowed character z<. Use a simple filesystem path without shell metacharacters.N)r)rrs& r_validate_workdirr&s?mmm$R((A"HMM  rc<V^8dQhR\R\R\/#)rcommandlimitr )rintr )r s"rrr2s! - -3 -s -S -rcVfR#\V\4'dVRV#\V4RV# \dR\ T4P R2u#i;i)z>Return a log-safe preview for possibly-invalid command values.Nz<>) isinstancer repr Exceptiontype__name__)rrs&&r_safe_command_previewr)2sb'3v-G}Ve$$ -4=))*!,,-s 1$AAc<V^8dQhR\R\R\/#)rerrorstatusr r)r s"rrr>s&lllclclrc B\P!RRR^RVRV/RR7#)zs% ::x[!WeXvVej kkrz=(?:^|[;&|]\s*|&&\s*|\|\|\s*|\$\(\s*)(?:nohup|disown|setsid)\bz\s&\sz\s&\s*(?:#.*)?$c0V^8dQhR\R\/#rrr r)r s"rrrJs , ,3 ,3 ,rc\V4p\P!RRV4p\P!RRV4p\P!RRV4#)uBlank quoted / backtick content and provably-inert heredoc bodies so regex checks can't match keywords (nohup, setsid, '&') inside strings. Heredocs are masked FIRST: their delimiter may itself be quoted (``<<'EOF'``). ``strip_inert_heredoc_bodies`` is conservative — only a quoted, terminated delimiter on a simple opener fed to a known non-shell consumer is masked, so a real background operator can't hide in one. z'[^']*'z''z"(?:[^"\\]|\\.)*"z""z`[^`]*`z``)rresub)rresults& r _strip_quotesr:JsF( 0F VVJf -F VV($ 7F 66*dF ++rc#l"TF*p\P!V\P4xK, R#5iN)r7compile IGNORECASE).0ps& r rAYs, ( O 1bmm(D(D Os24a Foreground command uses shell-level background wrappers (nohup/disown/setsid). Re-send WITHOUT the wrapper as terminal(command="", background=true, notify_on_complete=true) so Hermes tracks the process, then run readiness checks and tests in separate commands.cf\PV4;'g\PV4#r<)_INLINE_BACKGROUND_AMP_REsearch_TRAILING_BACKGROUND_AMP_REss&rrHns(+2215^^9T9[9[\]9^^ruForeground command uses '&' backgrounding. Re-send WITHOUT the '&' as terminal(command="", background=true) — add notify_on_complete=true for bounded jobs — then run health checks and tests in follow-up terminal calls.ca\;QJd#V3Rl\4F 'gK R# R#!V3Rl\44#)c3D<"TFqPS4xK R#5ir<)rD)r?r@rGs& rrA..tsK+Jahhqkk+Js TF)any_LONG_LIVED_FOREGROUND_PATTERNSrFsfrrHrHts*##K+JK##K#K#K+JKKrzThis foreground command appears to start a long-lived server/watch process. Run it with background=true, verify readiness (health endpoint/log signal), then execute tests in a separate command.c0V^8dQhR\R\/#r5r )r s"rrr|srcRPVP4P44pRV9;'g8VPR4;'gRV9;'gVPR4#)zGReturn True for informational invocations that should never be blocked. z --helpz -hz --versionz -v)joinlowersplitendswith)r normalizeds& r#_looks_like_help_or_version_commandrV|sp'--///12JZ & &   u % & & : % & &   u % rc>V^8dQhR\R\R,/#rrr Nr)r s"rrrs"SSSSS4ZSrcta\V4'dR#\V4o\V3Rl\4R4#)zGuidance text when a foreground command looks long-lived or uses shell backgrounding (it should be a managed background session), else None.Nc3L<"TFwrV!S4'gKVxK R#5ir<)r?hitmsgunquoteds& rrA2_foreground_background_guidance..sK%9S]%9s$ $)rVr:next_FOREGROUND_GUIDANCE)rr^s&@r_foreground_background_guidancerbs1+733W%H K%9KT RRrz&&|\d*[<>]&(?:\d+|-)?|&>>?|\|&z\s&\s*$c0V^8dQhR\R\/#r5r)r s"rrrs    rcPVP4RRp\V4pV'd}W^, ,P4'dZ\VRV^, 4\VRV^, PR44, pV^,'dM V^,pKVRV#)a*command* minus its final `&` and the UNESCAPED whitespace right before it. A backslash-escaped space is part of the last argument (`trailing\ ` is the word `trailing `), so trimming stops at the first whitespace byte preceded by an odd run of backslashes. N\)rstriplenisspace)rbodyend backslashess& r_strip_trailing_amprms >> CR D d)C $Qw-''))$xa.)CXcAg0E0Ed0K,LL ??  q :rc0V^8dQhR\R\/#r5)r tuple)r s"rrrsrc ^RIHp^RIHpHp^RIHpHpHp\V!V44\V!V44\V!V44V!V4V!V4\V!V443#)a Everything the approval path keys a decision on for *command*: hardline verdict, the dangerous pattern key/description (what session/permanent approvals are stored under), the sudo-stdin floor, runtime self-delete, the user's deny rules and the permanent allowlist.)command_deletes_runtime)$_command_matches_permanent_allowlist_match_user_deny_rule)_check_sudo_stdin_guarddetect_dangerous_commanddetect_hardline_command) agent.runtime_self_protectionrqtools.approvalrrrstools.approval_detectionrtrurvror )rrqrrrsrtrurvs& r_approval_identityrzscFZss %g./ &w/0 %g./(g& 1' :;  rc>V^8dQhR\R\R,/#rXr)r s"rrrsSS4Zrca\S\4'd\S4'dR#\;QJd#V3Rl\4F 'gK RM RM!V3Rl\44'dR#\ S4p\ PV4'd&SP4PR4'gR#VP4RR pRV9g1RV9g*RV9g#R V9g\PV4'dR#R\PR V49dR#\S4pVP4'gR#\S4\V48wdR#V#) aThe command without its trailing `&` when that `&` is its ONLY backgrounding, else None. Only the unambiguous shape converts: one line, one and-or list or pipeline (`a && b | c &` backgrounds the whole list in bash, exactly what background=true runs), nothing after the `&`. Inline `a & b`, `;` sequences, multi-line scripts/heredocs, nohup/disown/setsid and any executable substitution (`$(...)`, backticks, `<(...)`/`>(...)`) keep the refusal: the tool cannot prove there is no other background job or that later commands don't depend on a readiness check. Quoted `&` (and inert heredoc bodies) never count. Conversion must leave the approval identity untouched, otherwise the refusal stands. Nc3,<"TF qS9xK R#5ir<r[)r?markerrs& rrA2trailing_amp_background_command..s L+KW +KsTF&  ;#rrf)r$r rVrL _EXECUTABLE_SUBSTITUTION_MARKERSr:_TRAILING_AMP_ONLY_RErDrgrT_SHELL_LEVEL_BACKGROUND_RE_NON_BACKGROUND_AMP_REr8rmstriprz)rr^rjstrippedsf rtrailing_amp_background_commandrs  gs # #'J7'S'S s L+K Lsss L+K LLLW%H ' ' 1 19I9R9RSV9W9W ?? Sb !D t|tt|sd{cTkE_EfEfgkElEl $((T22"7+H >>  '"&8&BB Orc jV^8dQhR\R\R\R\R\\,/#)renv guard_cwd script_path max_bytesr )rr r r)r s"rrrs7#RUZbcfZgrcVfR#\V4P4pVP4'g\V4V, pVP4'dVP 4p\P !VP 4'dNVPV8:d=VP4p\V4V8:dRV9dR#VPRRR7#TPRT^, R\P!T4 24pTPRR 4^8Xd&TPR R 4pT'd R T9dR#T#R# \dLi;i \dR#i;i) aBest-effort script read: host filesystem first, then a bounded ``env.execute('head -c ... < path')`` for remote backends. Binary content (NUL byte) is not a script: feeding it to the guard tokenizes machine code into bogus paths and crashes the scanner, so it yields None.Nzutf-8replace)errorszhead -c z < returncoder.rrf)r expanduser is_absoluteis_filestatS_ISREGst_modest_size read_bytesrhdecoder&executeshlexquoteget) rrrr local_pathmetadatadatar9r.s &&&& r_read_script_for_guardrsP  {  +&113 %%''i:5J     !(H||H,,--(2B2Bi2O!,,.t9 )#*d?4^ GT] 8^^ x A c%++k:R9STU ::lB '1 ,ZZ"-F!f&64 BF B -         sCAE5E9EE#A"E%E%E% E"!E"% E43E4cV^8dQhR\R\R\R\R\\,R\R\\,/#)rrrenv_typecwdr session_keyr )r rr)r s"rrrsaUU U U U U c] UUc]Urc  aaa^RIHp^RIHpHpV!4'gR#^RIHoHp Hp H p H p H p V !V4'dV !V4'd \RR4#V!V4pVf\SRR4;'gTpV!WNWR\SRR4SR 7oV !VSVVV3R lR 7wppV'dV'd\R V R 2R4#V'd5V !V4'dV !V4'd \V R4#\RR4#R#)uRefuse gateway lifecycle commands issued from inside the supervised gateway. ``systemctl``/``launchctl``/``hermes gateway restart|stop|uninstall`` targeting hermes-gateway would SIGTERM the gateway — and this very subprocess — before completing, so the service may never come back. Applies unconditionally (``force=True`` cannot bypass it). Gated on the SUPERVISED-gateway probe, not the raw ``_HERMES_GATEWAY`` marker: that marker leaks into every process that merely imports gateway.run (hermes serve, CLI, web server), which must still be able to restart the gateway; an unsupervised foreground ``hermes gateway run`` has no KeepAlive to turn a self-restart into a respawn loop, so it passes too. Returns the JSON error string when blocked, else None. )_is_supervised_gateway_process)_resolve_command_cwdget_session_cwdN)_MAX_REFERENCED_SCRIPT_BYTESHOST_INTERPRETER_KILL_REJECTIONcontains_host_interpreter_kill!contains_launchctl_submit_command!lifecycle_scan_root_within_budgetscan_gateway_lifecycleaBlocked: launchctl submit/bootstrap is restricted inside a supervised gateway regardless of the job label, to prevent indirect gateway restart loops. This guard does not inspect the job's KeepAlive settings or determine whether it is independent of Hermes. Perform authorized LaunchAgent maintenance from a separate shell outside the gateway, not by switching launchctl verbs to bypass this rejection.r+rhost_cwd)r default_cwdrr mounted_hostrc <\SSVS4#r<)r)r@rrrs&rrH)gateway_lifecycle_block..:s%;CAOk%lr)rread_remote_scriptzOBlocked: the lifecycle guard could not scan this command or referenced script: z. Nothing in the command is known to contain a gateway lifecycle command, but a script the command executes must be scannable (a regular text file under 1 MiB) before it can run inside the gateway process.a+Blocked: command or referenced script cannot restart, stop, or uninstall the gateway from inside the gateway process. The gateway would kill this command before it could complete (SIGTERM propagates to child processes). Run `hermes gateway restart` from a separate shell outside the running gateway.)tools.process_registryrtools.terminal_toolrrcron.lifecycle_guardrrrrrrr3getattr)rrrrrrrrrrrrrrguard_cwd_baseunsaferefusalrrs$d$$$$ @@rgateway_lifecycle_blockrs),FI ) + +)116WX_6`6` I   %[1N eT299c$S*d3 I - lOFG ']^e]fg< <     -W 5 5:XY`:a:a !@'J J :     rc V^8dQhR\R\R\\,R\R\\,/#)rrrrrr )r r)r s"rrrWsD)) ) )c] )  ) c] )rc^RIHpHp^RIHpV!4'gR#V!W!VR7pV!W4wrV'gR#\ P R\V44\V R4#)uWindows-only guard against git-mutating the checkout backing this interpreter. NTFS locks loaded module files, so rewriting the live checkout can corrupt the running process; POSIX keeps old inodes alive for open handles, so the guard is off there (``guard_active``). Local backend only — remote backends cannot reach that checkout. Returns the JSON error string when blocked, else None. )detect_self_repo_git_mutation guard_active)rN)rrrz,Blocked self-repo git mutation (command: %s)blocked) tools.self_repo_guardrrrrloggerwarningr)r3) rrrrrrrrr\r]s $$$$ rself_repo_blockrWsWR8 >>$WS^_I,W@HC  NNACXY`Cab i ((r))z@\b(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?(?:dev|start|serve|watch)\bz\bdocker\s+compose\s+up\bz\bnext\s+dev\bz\bvite(?:\s|$)z \bnodemon\bz \buvicorn\bz \bgunicorn\bz$\bpython(?:3)?\s+-m\s+http\.server\b)z$(`z<(z>()+__doc__r1loggingr7rrpathlibrtypingrrtools.shell_heredocr getLoggerr frozensetrrrr)r3r=r> MULTILINErrCrEr:rorMrDrarVrbrrrrmrzrrrrr[rrrsj    :   0 1&o6;  -l  ZZDbmmVXVbVbFbJJx0 jj);< ,#(% ( O (%% ( O ( # #)) 1 _ ] L 4.S$EF :.$;   "DDUp)r