
    ,j-                    0
   U d Z ddlZddlZddlZddlZddlZddlZddlZddlZddl	m
Z
 ddlmZ ddlmZmZ  ej        e          Z e ej        dd                    Zeed<    ej        d	d
          Zej        e         ed<    ej        dd
          Zej        e         ed<    ej        dd
          Zej        e         ed<   deddfdZdedej        e         fdZdej        e         ddfdZddddedede ej        e         ej        e         f         fdZ!de ej        e         ej        e         f         ddfdZ"d
dedefdZ#defdZ$defd Z%d!Z&d"Z'd#Z(d$Z)d%Z*d&Z+d'Z,d(Z-d)e- d*Z.d+e. d,e& d-e' d-e( d-e+ d-e, d*Z/d+e) d-e* d*Z0d.Z1d/Z2d0d1d2d3d4d5d6d7e2d8z   d9fe2d:z   d;fe2d<z   d=fe2d>z   d?fgZ3ej4        ej5        z  Z6d@ e3D             Z7 ej8        dAej4                  Z9dBede fdCZ:dBede fdDZ;dEede<fdFZ=dEede<fdGZ>g dHdIdJdKdLdMdNdOdPdQdRdSdTdUe. dVfdWdXdYdZd[d\d6d]d^d_d`dae/ dbfdce/ ddfdae0 dee1 dffdce0 dee1 dgfdhdidjdkdldmdndodpdqdrdsdte. dufdve0 dee1 dwfdxe. dyfdze. d{fd|e( d-e' d*d}fd~e( d-e' d*dfde( d-e' d*dfdddddddddZ?d e?D             Z@dedefdZAi ZBe<eeCe         f         ed<   e?D ]x\  ZDZE eAeD          ZFeEZGeBH                    eG eC                      I                    eGeFh           eBH                    eF eC                      I                    eFeGh           ydedeCe         fdZJdBedefdZKdBedefdZLdBede fdZM ejN                    ZOi ZPe<ee<f         ed<   i ZQe<eeCf         ed<    eC            ZReCe         ed<    eC            ZSeCed<    G d d          ZTi ZUe<eeVf         ed<   i ZWe<eeXf         ed<   deddfdZYdeddfdZZ	 ddededede[fdZ\dedefdZ]dede<fdZ^dedefdZ_deddfdZ`deddfdZadeddfdZbdedefdZcdefdZddededefdZedefdZfdeCfdZgdeCfdZhdeCfdZi	 	 	 ddBedEede[dz  dedef
dZjdefdZkde<fdZldefdZmde[fdZndefdZodBedEedefdZp	 ddBedede<fdZqde<defdZrdddede<dede<fdÄZs	 ddBedede<fdĄZtdedede<fdƄZu eh             dS )a  Dangerous command approval -- detection, prompting, and per-session state.

This module is the single source of truth for the dangerous command system:
- Pattern detection (DANGEROUS_PATTERNS, detect_dangerous_command)
- Per-session approval state (thread-safe, keyed by session_key)
- Approval prompting (CLI interactive + gateway async)
- Smart approval via auxiliary LLM (auto-approve low-risk commands)
- Permanent allowlist persistence (config.yaml)
    N)Optional)cfg_get)env_var_enabledis_truthy_valueHERMES_YOLO_MODE _YOLO_MODE_FROZENapproval_session_keydefault_approval_session_keyapproval_turn_id_approval_turn_idapproval_tool_call_id_approval_tool_call_id	hook_namereturnc                 h   	 ddl m} n# t          $ r Y dS w xY w	 |                    dt                                                     |                    dt                                                      || fi | dS # t          $ r'}t                              d| |           Y d}~dS d}~ww xY w)a{  Invoke a plugin lifecycle hook for the approval system.

    Lazy-imports the plugin manager to avoid circular imports (approval.py is
    imported very early, long before plugins are discovered). Never raises --
    plugin errors are logged and swallowed.

    Only fires for the two approval-specific hooks in VALID_HOOKS:
    pre_approval_request, post_approval_response.
    r   )invoke_hookNturn_idtool_call_idz$Approval hook %s dispatch failed: %s)	hermes_cli.pluginsr   	Exception
setdefaultr   getr   loggerdebug)r   kwargsr   excs       3/home/ubuntu/.hermes/hermes-agent/tools/approval.py_fire_approval_hookr!   1   s    2222222    	M)%6%:%:%<%<===.*@*D*D*F*FGGGI((((((( M M M 	;YLLLLLLLLL	Ms$   	 
A#B   
B1
B,,B1session_keyc                 :    t                               | pd          S )z<Bind the active approval session key to the current context.r   )r   setr"   s    r    set_current_session_keyr&   M   s     $$[%6B777    tokenc                 :    t                               |            dS )z/Restore the prior approval session key context.N)r   reset)r(   s    r    reset_current_session_keyr+   R   s    &&&&&r'   r   r   r   r   c                 r    t                               | pd          t                              |pd          fS )z3Bind active tool correlation IDs to approval hooks.r   )r   r$   r   r,   s     r    !set_current_observability_contextr.   W   s9     	gm,,""<#5266 r'   tokensc                 x    | \  }}t                               |           t                              |           dS )z,Restore prior approval hook correlation IDs.N)r   r*   r   )r/   
turn_token
tool_tokens      r    #reset_current_observability_contextr3   c   s<     $J
  ,,,J'''''r'   r   c                 `    t                                           }|r|S ddlm}  |d|           S )a  Return the active session key, preferring context-local state.

    Resolution order:
    1. approval-specific contextvars (set by gateway before agent.run)
    2. session_context contextvars (set by _set_session_env)
    3. os.environ fallback (CLI, cron, tests)
    r   get_session_envHERMES_SESSION_KEY)r   r   gateway.session_contextr6   )r   r"   r6   s      r    get_current_session_keyr9   l   sH     (++--K 777777?/999r'   c                  z    	 ddl m}   | dd          pdS # t          $ r t          j        dd          pdcY S w xY w)zBReturn the current gateway platform from contextvars/env fallback.r   r5   HERMES_SESSION_PLATFORMr   )r8   r6   r   osgetenvr5   s    r    _get_session_platformr>   {   sj    >;;;;;;8"==CC > > >y2B77=2===>s    !::c                  |    t          d          rdS t          d          rdS t          t                                S )u  True when this call is inside a gateway/API session.

    Legacy gateway integrations set HERMES_GATEWAY_SESSION in process env.
    Newer concurrent gateway paths bind HERMES_SESSION_PLATFORM via
    contextvars so approval mode does not depend on process-global flags.

    Cron jobs are NEVER gateway-approval contexts even when they originate
    from a gateway platform (cron binds HERMES_SESSION_PLATFORM via
    contextvars for delivery routing). Cron approvals are governed by
    ``approvals.cron_mode`` config, not interactive resolve — letting cron
    fall through to the gateway branch would submit a pending approval
    with no listener and block the job indefinitely.
    HERMES_CRON_SESSIONFHERMES_GATEWAY_SESSIONT)r   boolr>    r'   r    _is_gateway_approval_contextrD      sE     ,-- u/00 t%''(((r'   z$(?:~|\$home|\$\{home\})/\.ssh(?:/|$)z\(?:~\/\.hermes/|(?:\$home|\$\{home\})/\.hermes/|(?:\$hermes_home|\$\{hermes_home\})/)\.env\bzc(?:~\/\.hermes/|(?:\$home|\$\{home\})/\.hermes/|(?:\$hermes_home|\$\{hermes_home\})/)config\.yaml\bz;(?:(?:/|\.{1,2}/)?(?:[^\s/"\'`]+/)*\.env(?:\.[^/\s"\'`]+)*)z0(?:(?:/|\.{1,2}/)?(?:[^\s/"\'`]+/)*config\.yaml)zJ(?:~|\$home|\$\{home\})/\.(?:bashrc|zshrc|profile|bash_profile|zprofile)\bz9(?:~|\$home|\$\{home\})/\.(?:netrc|pgpass|npmrc|pypirc)\bz/private/(?:etc|var|tmp|home)/z	(?:/etc/|)z(?:z	|/dev/sd||z(?:\s*(?:&&|\|\||;).*)?$zp(?:^|[;&|\n`]|\$\()\s*(?:sudo\s+(?:-[^\s]+\s+)*)?(?:env\s+(?:\w+=\S*\s+)*)?(?:(?:exec|nohup|setsid|time)\s+)*\s*)z&\brm\s+(-[^\s]*\s+)*(/|/\*|/ \*)(\s|$)z#recursive delete of root filesystem)z\brm\s+(-[^\s]*\s+)*(/home|/home/\*|/root|/root/\*|/etc|/etc/\*|/usr|/usr/\*|/var|/var/\*|/bin|/bin/\*|/sbin|/sbin/\*|/boot|/boot/\*|/lib|/lib/\*)(\s|$)z$recursive delete of system directory)z-\brm\s+(-[^\s]*\s+)*(~|\$HOME)(/?|/\*)?(\s|$)z"recursive delete of home directory)z\bmkfs(\.[a-z0-9]+)?\bzformat filesystem (mkfs))z9\bdd\b[^\n]*\bof=/dev/(sd|nvme|hd|mmcblk|vd|xvd)[a-z0-9]*zdd to raw block device)z.>\s*/dev/(sd|nvme|hd|mmcblk|vd|xvd)[a-z0-9]*\bzredirect to raw block device)z(:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:z	fork bomb)z\bkill\s+(-[^\s]+\s+)*-1\bkill all processesz!(shutdown|reboot|halt|poweroff)\bzsystem shutdown/rebootzinit\s+[06]\bzinit 0/6 (shutdown/reboot)z*systemctl\s+(poweroff|reboot|halt|kexec)\bzsystemctl poweroff/rebootztelinit\s+[06]\bztelinit 0/6 (shutdown/reboot)c                 L    g | ]!\  }}t          j        |t                    |f"S rC   recompile	_RE_FLAGS.0patterndescriptions      r    
<listcomp>rQ     s=        Z##[1  r'   z)(?:^|[;&|`\n]|&&|\|\||\$\()\s*sudo\s+-S\bcommandc                     dt           j        v rdS t          |                                           }t                              |          rdS dS )u  Detect ``sudo -S`` (stdin password) without configured SUDO_PASSWORD.

    When SUDO_PASSWORD is set, ``_transform_sudo_command`` injects ``-S``
    internally — that path is legitimate and handled elsewhere.  This guard
    only fires when SUDO_PASSWORD is *not* set, meaning the LLM explicitly
    wrote ``sudo -S`` to pipe a guessed password.

    Returns:
        (is_blocked: bool, description: str | None)
    SUDO_PASSWORDFN)Tz*sudo password guessing via stdin (sudo -S))r<   environ _normalize_command_for_detectionlower_SUDO_STDIN_REsearch)rR   
normalizeds     r    _check_sudo_stdin_guardr\   3  sQ     "*$$}1'::@@BBJZ(( DCC=r'   c                     t          |                                           }t          D ] \  }}|                    |          rd|fc S !dS )zCheck if a command matches the unconditional hardline blocklist.

    Returns:
        (is_hardline, description) or (False, None)
    TrU   )rW   rX   HARDLINE_PATTERNS_COMPILEDrZ   )rR   r[   
pattern_rerP   s       r    detect_hardline_commandr`   F  sb     2'::@@BBJ#= ' '
KZ(( 	'+&&&&	'=r'   rP   c                     ddd|  ddS )z5Build the standard block result for a hardline match.FTzBLOCKED (hardline): u   . This command is on the unconditional blocklist and cannot be executed via the agent — not even with --yolo, /yolo, approvals.mode=off, or cron approve mode. If you genuinely need to run it, run it yourself in a terminal outside the agent.)approvedhardlinemessagerC   rP   s    r    _hardline_block_resultrf   S  s/     ;   	  r'   c                     dd|  ddS )z5Build the standard block result for sudo stdin guard.Fz	BLOCKED: u   . Do not pipe passwords to 'sudo -S' — this is a brute-force attack vector. Set SUDO_PASSWORD in your .env file if the agent needs passwordless sudo, or run the sudo command manually in your own terminal.rb   rd   rC   re   s    r    _sudo_stdin_block_resultri   c  s,     - - - -	 	 	r'   )z\brm\s+(-[^\s]*\s+)*/zdelete in root path)z\brm\s+-[^\s]*rzrecursive delete)z\brm\s+--recursive\bzrecursive delete (long flag))z8\bchmod\s+(-[^\s]*\s+)*(777|666|o\+[rwx]*w|a\+[rwx]*w)\bz world/other-writable permissions)z8\bchmod\s+--recursive\b.*(777|666|o\+[rwx]*w|a\+[rwx]*w)z*recursive world/other-writable (long flag))z\bchown\s+(-[^\s]*)?R\s+rootzrecursive chown to root)z\bchown\s+--recursive\b.*rootz#recursive chown to root (long flag))z\bmkfs\bzformat filesystem)z\bdd\s+.*if=z	disk copy)z>\s*/dev/sdzwrite to block device)z\bDROP\s+(TABLE|DATABASE)\bzSQL DROP)z$\bDELETE\s+FROM\b(?![^\n]*\bWHERE\b)zSQL DELETE without WHERE)z\bTRUNCATE\s+(TABLE)?\s*\wzSQL TRUNCATEz>\s*zoverwrite system config)z8\bsystemctl\s+(-[^\s]+\s+)*(stop|restart|disable|mask)\bzstop/restart system service)z\bkill\s+-9\s+-1\brG   )z\bpkill\s+-9\bzforce kill processes)z,\bkillall\s+(-[^\s]*\s+)*-(9|KILL|SIGKILL)\bz$force kill processes (killall -KILL))z0\bkillall\s+(-[^\s]*\s+)*-s\s+(KILL|SIGKILL|9)\bz&force kill processes (killall -s KILL))z\bkillall\s+(-[^\s]*\s+)*-r\bz$kill processes by regex (killall -r))z%\b(bash|sh|zsh|ksh)\s+-[^\s]*c(\s+|$)zshell command via -c/-lc flag)z)\b(python[23]?|perl|ruby|node)\s+-[ec]\s+zscript execution via -e/-c flag)z6\b(curl|wget)\b.*\|\s*(?:[/\w]*/)?(?:ba)?sh(?:\s|$|-c)zpipe remote content to shell)z1\b(bash|sh|zsh|ksh)\s+<\s*<?\s*\(\s*(curl|wget)\bz.execute remote script via process substitutionz\btee\b.*["\']?zoverwrite system file via teez>>?\s*["\']?z%overwrite system file via redirectionz["\']?z$overwrite project env/config via teez,overwrite project env/config via redirection)z\bxargs\s+.*\brm\bzxargs with rm)z&\bfind\b.*-exec(?:dir)?\s+(/\S*/)?rm\bzfind -exec/-execdir rm)z\bfind\b.*-delete\bzfind -delete)z%\bhermes\s+gateway\s+(stop|restart)\bz2stop/restart hermes gateway (kills running agents))z\bhermes\s+update\bz6hermes update (restarts gateway, kills running agents))z/\bdocker\s+compose\s+(restart|stop|kill|down)\bz;docker compose restart/stop/kill/down (container lifecycle))z \bdocker\s+(restart|stop|kill)\bz.docker restart/stop/kill (container lifecycle))z4gateway\s+run\b.*(&\s*$|&\s*;|\bdisown\b|\bsetsid\b)Mstart gateway outside systemd (use 'systemctl --user restart hermes-gateway'))z\bnohup\b.*gateway\s+run\brj   )z1\b(pkill|killall)\b.*\b(hermes|gateway|cli\.py)\bz.kill hermes/gateway process (self-termination))z\bkill\b.*\$\(\s*pgrep\bz3kill process via pgrep expansion (self-termination))z\bkill\b.*`\s*pgrep\bz<kill process via backtick pgrep expansion (self-termination)z\b(cp|mv|install)\b.*\sz&copy/move file into system config pathz\b(cp|mv|install)\b.*\s["\']?z!overwrite project env/config filez\bsed\s+-[^\s]*i.*\szin-place edit of system configz\bsed\s+--in-place\b.*\sz*in-place edit of system config (long flag)z\bsed\s+-[^\s]*i.*(?:z"in-place edit of Hermes config/envz\bsed\s+--in-place\b.*(?:z.in-place edit of Hermes config/env (long flag)z*\b(?:perl|ruby)\b.*(?:^|\s)-[^\s]*i\b.*(?:z.in-place edit of Hermes config/env (perl/ruby))z#\b(python[23]?|perl|ruby|node)\s+<<zscript execution via heredoc)z\bgit\s+reset\s+--hard\bz/git reset --hard (destroys uncommitted changes))z\bgit\s+push\b.*--force\bz(git force push (rewrites remote history))z\bgit\s+push\b.*-f\bz3git force push short flag (rewrites remote history))z\bgit\s+clean\s+-[^\s]*fz.git clean with force (deletes untracked files))z\bgit\s+branch\s+-D\bzgit branch force delete)z\bchmod\s+\+x\b.*[;&|]+\s*\./z(chmod +x followed by immediate execution)z8\bsudo\b[^;|&\n]*?\s+(?:-s\b|--stdin\b|-a\b|--askpass\b)z3sudo with privilege flag (stdin/askpass/shell/list))z(\bsudo\b[^;|&\n]*?\s+-[a-z]*[sa][a-z]*\bz,sudo with combined-flag privilege escalationc                 L    g | ]!\  }}t          j        |t                    |f"S rC   rI   rM   s      r    rQ   rQ     s=        Z##[1  r'   rO   c                 T    d| v r|                      d          d         n	| dd         S )zIReproduce the old regex-derived approval key for backwards compatibility.z\b   N   )split)rO   s    r    _legacy_pattern_keyrp     s0    &+w&6&67==""GCRCLHr'   _PATTERN_KEY_ALIASESpattern_keyc                 :    t                               | | h          S )zReturn all approval keys that should match this pattern.

    New approvals use the human-readable description string, but older
    command_allowlist entries and session approvals may still contain the
    historical regex-derived key.
    )rq   r   rr   s    r    _approval_key_aliasesru     s      ##K+???r'   c                     ddl m}  ||           } |                     dd          } t          j        d|           } t          j        dd|           } t          j        dd|           } t          |           } | S )	a  Normalize a command string before dangerous-pattern matching.

    Strips ANSI escape sequences (full ECMA-48 via tools.ansi_strip),
    null bytes, and normalizes Unicode fullwidth characters so that
    obfuscation techniques cannot bypass the pattern-based detection.
    r   )
strip_ansi r   NFKCz	\\([^\n])z\1z''|\"\")tools.ansi_striprw   replaceunicodedata	normalizerJ   sub_rewrite_resolved_hermes_home)rR   rw   s     r    rW   rW     s     ,+++++ j!!Goofb))G#FG44Gf\5'22GfZW--G ,G44GNr'   c                 :   	 ddl m}  |                                            }t          |                              d          t          |                    d                                        d          g}n# t          $ r | cY S w xY wt                      }|D ]{}|r||v r	|                    |           |                    d          }|	                    d          r|
                    d          dk     rb|                     |dz   d          } || S )a{  Rewrite the resolved absolute Hermes home prefix to ``~/.hermes/``.

    Resolves the active ``HERMES_HOME`` at call time (and its symlink-resolved
    form) and replaces an occurrence of ``<home>/`` in *command* with
    ``~/.hermes/`` so the static ``_HERMES_CONFIG_PATH`` / ``_HERMES_ENV_PATH``
    patterns match. No-op when the path can't be resolved or doesn't appear.
    r   )get_hermes_home/F)strict   z
~/.hermes/)hermes_constantsr   
expanduserstrrstripresolver   r$   add
startswithcountr{   )rR   r   home
candidatesseenpathr[   s          r    r   r   1  s>   444444  ++--IIS!!E**++22377


    UUD B B 	tt||
 [[%%
$$S)) 	Z-=-=c-B-BQ-F-F//*s"2LAANs   A:A= =BBc                     t          |                                           }t          D ]#\  }}|                    |          r	|}d||fc S $dS )zCheck if a command matches any dangerous patterns.

    Returns:
        (is_dangerous, pattern_key, description) or (False, None, None)
    T)FNN)rW   rX   DANGEROUS_PATTERNS_COMPILEDrZ   )rR   command_lowerr_   rP   rr   s        r    detect_dangerous_commandr   R  sl     5W==CCEEM#> 4 4
K]++ 	4%K+{3333	4 r'   _pending_session_approved_session_yolo_permanent_approvedc                   "    e Zd ZdZdZdefdZdS )_ApprovalEntryz@One pending dangerous-command approval inside a gateway session.)eventdataresultr   c                 R    t          j                    | _        || _        d | _        d S N)	threadingEventr   r   r   )selfr   s     r    __init__z_ApprovalEntry.__init__w  s#    _&&
	%)r'   N)__name__
__module____qualname____doc__	__slots__dictr   rC   r'   r    r   r   s  s:        JJ+I*T * * * * * *r'   r   _gateway_queues_gateway_notify_cbsc                 Z    t           5  |t          | <   ddd           dS # 1 swxY w Y   dS )ua  Register a per-session callback for sending approval requests to the user.

    The callback signature is ``cb(approval_data: dict) -> None`` where
    *approval_data* contains ``command``, ``description``, and
    ``pattern_keys``.  The callback bridges sync→async (runs in the agent
    thread, must schedule the actual send on the event loop).
    N)_lockr   )r"   cbs     r    register_gateway_notifyr     sy     
 . .+-K(. . . . . . . . . . . . . . . . . .    $$c                     t           5  t                              | d           t                              | g           }ddd           n# 1 swxY w Y   |D ]}|j                                         dS )zUnregister the per-session gateway approval callback.

    Signals ALL blocked threads for this session so they don't hang forever
    (e.g. when the agent run finishes or is interrupted).
    N)r   r   popr   r   r$   r"   entriesentrys      r    unregister_gateway_notifyr     s     
 7 7T222!%%k2667 7 7 7 7 7 7 7 7 7 7 7 7 7 7    s   7AAAFchoiceresolve_allc                    t           5  t                              |           }|s	 ddd           dS |r$t          |          }|                                 n|                    d          g}|st                              | d           ddd           n# 1 swxY w Y   |D ]"}||_        |j                                         #t          |          S )aT  Called by the gateway's /approve or /deny handler to unblock
    waiting agent thread(s).

    When *resolve_all* is True every pending approval in the session is
    resolved at once (``/approve all``).  Otherwise only the oldest one
    is resolved (FIFO).

    Returns the number of approvals resolved (0 means nothing was pending).
    Nr   )
r   r   r   listclearr   r   r   r$   len)r"   r   r   queuetargetsr   s         r    resolve_gateway_approvalr     s1    
 
3 
3##K00 	
3 
3 
3 
3 
3 
3 
3 
3  	%5kkGKKMMMMyy||nG 	3T222
3 
3 
3 
3 
3 
3 
3 
3 
3 
3 
3 
3 
3 
3 
3   w<<s   BABBBc                     t           5  t          t                              |                     cddd           S # 1 swxY w Y   dS )zFCheck if a session has one or more blocking gateway approvals waiting.N)r   rB   r   r   r%   s    r    has_blocking_approvalr     s    	 6 6O''44556 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6s   '<A A approvalc                 Z    t           5  |t          | <   ddd           dS # 1 swxY w Y   dS )z/Store a pending approval request for a session.N)r   r   )r"   r   s     r    submit_pendingr     sv    	 ) ) () ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) )r   c                     t           5  t                              | t                                                    |           ddd           dS # 1 swxY w Y   dS )z(Approve a pattern for this session only.N)r   r   r   r$   r   )r"   rr   s     r    approve_sessionr     s    	 J J$$[#%%88<<[IIIJ J J J J J J J J J J J J J J J J Js   ;AAAc                     | sdS t           5  t                              |            ddd           dS # 1 swxY w Y   dS )z,Enable YOLO bypass for a single session key.N)r   r   r   r%   s    r    enable_session_yolor     s     	 ' '+&&&' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' '   488c                     | sdS t           5  t                              |            ddd           dS # 1 swxY w Y   dS )z-Disable YOLO bypass for a single session key.N)r   r   discardr%   s    r    disable_session_yolor     s     	 + +k***+ + + + + + + + + + + + + + + + + +r   c                 l   | sdS t           5  t                              | d           t                              |            t
                              | d           t                              | g           }ddd           n# 1 swxY w Y   |D ]"}d|_        |j        	                                 #dS )z7Remove all approval and yolo state for a given session.Ndeny)
r   r   r   r   r   r   r   r   r   r$   r   s      r    clear_sessionr     s     	 7 7k4000k***[$'''!%%k266	7 7 7 7 7 7 7 7 7 7 7 7 7 7 7
    	 s   A,BBBc                 ^    | sdS t           5  | t          v cddd           S # 1 swxY w Y   dS )z?Return True when YOLO bypass is enabled for a specific session.FN)r   r   r%   s    r    is_session_yolo_enabledr     s     u	 , ,m+, , , , , , , , , , , , , , , , , ,s   	"&&c                  <    t          t          d                    S )zEReturn True when the active approval session has YOLO bypass enabled.r   r   )r   r9   rC   r'   r    is_current_session_yolo_enabledr     s    "#:2#F#F#FGGGr'   c                 6   t          |          }t          5  t          d |D                       r	 ddd           dS t                              | t                                t          fd|D                       cddd           S # 1 swxY w Y   dS )zCheck if a pattern is approved (session-scoped or permanent).

    Accept both the current canonical key and the legacy regex-derived key so
    existing command_allowlist entries continue to work after key migrations.
    c              3   (   K   | ]}|t           v V  d S r   )r   )rN   aliass     r    	<genexpr>zis_approved.<locals>.<genexpr>  s(      AAu++AAAAAAr'   NTc              3       K   | ]}|v V  	d S r   rC   )rN   r   session_approvalss     r    r   zis_approved.<locals>.<genexpr>  s)      CC%5--CCCCCCr'   )ru   r   anyr   r   r$   )r"   rr   aliasesr   s      @r    is_approvedr     s    $K00G	 D DAAAAAAA 	D D D D D D D D .11+suuEECCCC7CCCCC	D D D D D D D D D D D D D D D D D Ds   B ABBBc                 z    t           5  t                              |            ddd           dS # 1 swxY w Y   dS )z)Add a pattern to the permanent allowlist.N)r   r   r   rt   s    r    approve_permanentr     s    	 - -,,,- - - - - - - - - - - - - - - - - -   044patternsc                 z    t           5  t                              |            ddd           dS # 1 swxY w Y   dS )z2Bulk-load permanent allowlist entries from config.N)r   r   update)r   s    r    load_permanentr   
  s    	 - -""8,,,- - - - - - - - - - - - - - - - - -r   c                     	 ddl m}   |             }t          |                    dg           pg           }|rt	          |           |S # t
          $ r3}t                              d|           t                      cY d}~S d}~ww xY w)zLoad permanently allowed command patterns from config.

    Also syncs them into the approval module so is_approved() works for
    patterns added via 'always' in a previous session.
    r   load_configcommand_allowlistz&Failed to load permanent allowlist: %sN)hermes_cli.configr   r$   r   r   r   r   warning)r   configr   es       r    load_permanent_allowlistr     s    	111111vzz"5r::@bAA 	%8$$$   ?CCCuus   AA
 

B(B<BBc                     	 ddl m}m}  |            }t          |           |d<    ||           dS # t          $ r&}t
                              d|           Y d}~dS d}~ww xY w)z4Save permanently allowed command patterns to config.r   )r   save_configr   zCould not save allowlist: %sN)r   r   r   r   r   r   r   )r   r   r   r   r   s        r    save_permanent_allowlistr   '  s    :>>>>>>>>&*8nn"#F : : :5q999999999:s   /3 
A#AA#Ttimeout_secondsallow_permanentc                 	  
 |t                      }|D	  || |          S # t          $ r(}t                              d|d           Y d}~dS d}~ww xY w	 ddlm}  |            t                              d	| |           dS n# t          $ r Y nw xY wd
t          j        d<   	 ddl	m
 	 t                       t          d d|                      t          d|             t                       rt           d                     nt           d                     t                       t          j                                         ddi

fd}t          j        |d          }|                                 |                    |           |                                ret          d d          z              	 dt          j        v rt          j        d= t                       t          j                                         dS 
d         }	|	dv rbt           d                     	 dt          j        v rt          j        d= t                       t          j                                         dS |	dv rbt           d                     	 dt          j        v rt          j        d= t                       t          j                                         dS |	d v rƉsbt           d                     	 dt          j        v rt          j        d= t                       t          j                                         dS t           d!                     	 dt          j        v rt          j        d= t                       t          j                                         d"S t           d#                     	 dt          j        v rt          j        d= t                       t          j                                         dS # t(          t*          f$ rf t          d d$          z              Y dt          j        v rt          j        d= t                       t          j                                         dS w xY w# dt          j        v rt          j        d= t                       t          j                                         w xY w)%a  Prompt the user to approve a dangerous command (CLI only).

    Args:
        allow_permanent: When False, hide the [a]lways option (used when
            tirith warnings are present, since broad permanent allowlisting
            is inappropriate for content-level security findings).
        approval_callback: Optional callback registered by the CLI for
            prompt_toolkit integration. Signature:
            (command, description, *, allow_permanent=True) -> str.

    Returns: 'once', 'session', 'always', or 'deny'
    N)r   zApproval callback failed: %sT)exc_infor   r   )get_app_or_nonezDangerous-command approval requested on a thread with no approval callback while prompt_toolkit is active; denying to avoid stdin deadlock. command=%r description=%r1HERMES_SPINNER_PAUSE)tz  zapproval.dangerous_headerre   z      zapproval.choose_longzapproval.choose_shortr   r   c                      	 r d          n
 d          } t          |                                                                           d<   d S # t          t          f$ r	 dd<   Y d S w xY w)Nzapproval.prompt_longzapproval.prompt_shortr   r   )inputstriprX   EOFErrorOSError)promptr   r   r   s    r    	get_inputz,prompt_dangerous_approval.<locals>.get_input  s    *:IiQQ5666qqQhOiOiF',V}}':':'<'<'B'B'D'DF8$$$ '* * * *')F8$$$$*s   AA A-,A-)targetdaemontimeout
zapproval.timeout>   ooncezapproval.allowed_oncer  >   ssessionzapproval.allowed_sessionr  >   aalwayszapproval.allowed_alwaysr	  zapproval.deniedzapproval.cancelled)_get_approval_timeoutr   r   error"prompt_toolkit.application.currentr   r   r<   rV   
agent.i18nr   printsysstdoutflushr   Threadstartjoinis_aliver   KeyboardInterrupt)rR   rP   r   r   approval_callbackr   r   r   threadr   r   r   s      `      @@r    prompt_dangerous_approvalr  6  sh     /11$	$$Wk5DF F F F 	 	 	LL7TLJJJ66666	FFFFFF?(NNE 	   6 )     		 *-BJ%&9 	!     ,	GGGPqq4+NNNPPQQQ$7$$%%%GGG 2aa.//0000aa/00111GGGJ^F* * * * * * * %YtDDDFLLNNNKKK000   dQQ1222333. "RZ//
12
1 H%F&&aa/00111$ "RZ//
12
) +++aa233444  "RZ//
12
# ?**& %!!677888$ "RZ//
12
 aa122333 "RZ//
12
 aa)**+++ "RZ//
12
 '(   dQQ+,,,---!RZ//
12
 "RZ//
12
sj   % 
AAA,B
 

BB*D+P $P P 3P P =P ,RR RR A	S"c                     t          | t                    r| du rdndS t          | t                    r*|                                                                 }|pdS dS )a"  Normalize approval mode values loaded from YAML/config.

    YAML 1.1 treats bare words like `off` as booleans, so a config entry like
    `approvals:
  mode: off` is parsed as False unless quoted. Treat that as the
    intended string mode instead of falling back to manual approvals.
    Foffmanual)
isinstancerB   r   r   rX   )moder[   s     r    _normalize_approval_moder    sc     $ 4uu83$ &ZZ\\''))
%X%8r'   c                      	 ddl m}   |             }|                    di           pi S # t          $ r'}t                              d|           i cY d}~S d}~ww xY w)zLRead the approvals config block. Returns a dict with 'mode', 'timeout', etc.r   r   	approvalsz"Failed to load approval config: %sN)r   r   r   r   r   r   )r   r   r   s      r    _get_approval_configr"    s    111111zz+r**0b0   ;Q???						s   '* 
AAAAc                  d    t                                          dd          } t          |           S )zHRead the approval mode from config. Returns 'manual', 'smart', or 'off'.r  r  )r"  r   r  )r  s    r    _get_approval_moder$    s+    !!%%fh77D#D)))r'   c                      	 t          t                                          dd                    S # t          t          f$ r Y dS w xY w)z>Read the approval timeout from config. Defaults to 60 seconds.r  <   )intr"  r   
ValueError	TypeErrorrC   r'   r    r
  r
    sS    '))--i<<===	"   rrs   .1 AAc                      	 ddl m}   |             }t          t          |ddd                                                                                    }|dv rdS dS # t          $ r Y dS w xY w)	zERead the cron approval mode from config. Returns 'deny' or 'approve'.r   r   r!  	cron_moder   r   >   r  yesallowapprover.  )r   r   r   r   rX   r   r   )r   r   r  s      r    _get_cron_approval_moder/    s    11111176;VLLLMMSSUU[[]]5559v   vvs   AA 
A,+A,c                 L   	 ddl m} d|  d| d} |dd|dgdd	
          }|j        d         j        j        pd                                                                }|dk    rdS |dk    rdS dS # t          $ r&}t          	                    d|           Y d}~dS d}~ww xY w)a  Use the auxiliary LLM to assess risk and decide approval.

    Returns 'approve' if the LLM determines the command is safe,
    'deny' if genuinely dangerous, or 'escalate' if uncertain.

    Inspired by OpenAI Codex's Smart Approvals guardian subagent
    (openai/codex#13860).
    r   )call_llmzYou are a security reviewer for an AI coding agent. A terminal command was flagged by pattern matching as potentially dangerous.

Command: z
Flagged reason: ul  

Assess the ACTUAL risk of this command. Many flagged commands are false positives — for example, `python -c "print('hello')"` is flagged as "script execution via -c flag" but is completely harmless.

Rules:
- APPROVE if the command is clearly safe (benign script execution, safe file operations, development tools, package installs, git operations, etc.)
- DENY if the command could genuinely damage the system (recursive delete of important paths, overwriting system files, fork bombs, wiping disks, dropping databases, etc.)
- ESCALATE if you're uncertain

Respond with exactly one word: APPROVE, DENY, or ESCALATEr   user)rolecontent   )taskmessagestemperature
max_tokensr   APPROVEr.  DENYr   escalatez1Smart approvals: LLM call failed (%s), escalatingN)
agent.auxiliary_clientr1  choicesrd   r4  r   upperr   r   r   )rR   rP   r1  r   responseanswerr   s          r    _smart_approverB    s   #333333=
= = = = = 8%&99:	
 
 
 "1%-5;BBDDJJLLY9v6:   H!LLLzzzzzs   A%A3 )A3 3
B#=BB#env_typec           
         |dv rdddS t          |           \  }}|r3t                              d|| dd                    t          |          S t          st                      rdddS t          |           \  }}}|sdddS t                      }t          ||          rdddS t          d          }	t                      }
|	sU|
sSt          d          rt                      d	k    r	d
d| ddS t                              d|| dd                    dddS |
st          d          r$t          || ||d           d
|d| |d| d|  ddS t          | ||          }|d	k    rd
d| d||dS |dk    rt          ||           n9|dk    r3t          ||           t          |           t!          t"                     dddS )a  Check if a command is dangerous and handle approval.

    This is the main entry point called by terminal_tool before executing
    any command. It orchestrates detection, session checks, and prompting.

    Args:
        command: The shell command to check.
        env_type: Terminal backend type ('local', 'ssh', 'docker', etc.).
        approval_callback: Optional CLI callback for interactive prompts.

    Returns:
        {"approved": True/False, "message": str or None, ...}
    >   modaldockerdaytonasingularityTNrh    Hardline block: %s (command: %s)   HERMES_INTERACTIVEr@   r   F'BLOCKED: Command flagged as dangerous () but cron jobs run without a user present to approve it. Find an alternative approach that avoids this command. To allow dangerous commands in cron jobs, set approvals.cron_mode: approve in config.yaml.u   AUTO-APPROVED dangerous command in non-interactive non-gateway context (pattern: %s): %s — set HERMES_INTERACTIVE or HERMES_GATEWAY_SESSION to require approval.HERMES_EXEC_ASK)rR   rr   rP   approval_requiredu.   ⚠️ This command is potentially dangerous (z3). Asking the user for approval.

**Command:**
```

```)rb   rr   statusrR   rP   rd   )r  zBBLOCKED: User denied this potentially dangerous command (matched 'zL' pattern). Do NOT retry this command - the user has explicitly rejected it.rb   rd   rr   rP   r  r	  )r`   r   r   rf   r	   r   r   r9   r   r   rD   r/  r   r  r   r   r   r   )rR   rC  r  is_hardlinehardline_descis_dangerousrr   rP   r"   is_cli
is_gatewayr   s               r    check_dangerous_commandrX    s    @@@ T222 "9!A!AK 59='RVSVRV-XXX%m444  3;== 3 T222-Eg-N-N*L+{ 3 T222)++K;,, 3 T222122F-//J 3* 3011 	&((F22 %G+ G G G	 	 	 	j#	
 	
 	

 !T222 
_%677 
{&&%
 %
 	 	 	 &)&V V VGNV V V

 

 
	
 'w9JL L LF  v\g  v  v  v&&	
 
 	
 [1111	8		[111+&&& !4555...r'   tirith_resultc           	         |                      d          pg }|s|                      d          pd}d| S g }|D ]}|                     dd          }|                     dd          }|                     dd          }|r*|r(|                    |rd	| d
| d| n| d|            p|r|                    |rd	| d
| n|           |s|                      d          pd}d| S dd                    |          z   S )zBuild a human-readable description from tirith findings.

    Includes severity, title, and description for each finding so users
    can make an informed approval decision.
    findingssummaryzsecurity issue detectedzSecurity scan: severityr   titlerP   [z] z: u   Security scan — ; )r   appendr  )rY  r[  r\  partsfr]  r^  descs           r    _format_tirith_descriptionre  y  so      ,,2H +##I..K2K****E I I55R((gr""uu]B'' 	IT 	ILLH\8X8888$888UJ\J\VZJ\J\]]]] 	ILLHG0X00000%HHH +##I..K2K****$))E"2"222r'   gatewaysurfaceapproval_datarh  c          
          |                     dd          }|                     dd          }|                     dd          }|                     d|g          }t          |          t          5  t                               g                                          ddd           n# 1 swxY w Y   d fd}t          d	|||t          |           |
           	  ||           nB# t          $ r5}	t          
                    d|	            |             ddddcY d}	~	S d}	~	ww xY wt                                           dd          }
	 t          |
          }
n# t          t          f$ r d}
Y nw xY w	 ddlm} n# t          $ r d}Y nw xY wt#          j                    }|t'          |
d          z   }||d}d}	 |t#          j                    z
  }|dk    rn;j                            t-          d|                    rd}n| ||d           X |             j        }|sdn|r|nd}t          d|||t          |           ||           ||dS )u  Enqueue *approval_data*, notify the user, and block the calling agent
    thread until the request is resolved or the gateway approval timeout
    elapses — firing pre/post approval hooks and cleaning up the queue entry.

    Shared by the terminal command guard (``check_all_command_guards``) and
    the execute_code guard (``check_execute_code_guard``) so the fiddly
    heartbeat-polling wait loop lives in one place.

    Returns ``{"resolved": bool, "choice": str|None}`` on completion, or
    ``{"resolved": False, "choice": None, "notify_failed": True}`` if the
    notify callback raised.  Persistence of an approved choice and building
    the final tool-facing result dict remain the caller's responsibility.
    rR   r   rP   rr   pattern_keysNr   c                      t           5  t                              g           } | v r|                                | st                              d            d d d            d S # 1 swxY w Y   d S r   )r   r   r   remover   )r   r   r"   s    r    _drop_entryz,_await_gateway_decision.<locals>._drop_entry  s     	7 	7#''R88E~~U### 7##K666	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7s   AA((A,/A,pre_approval_requestrR   rP   rr   rk  r"   rh  z"Gateway approval notify failed: %sFT)resolvedr   notify_failedgateway_timeouti,  r   )touch_activity_if_due)
last_touchr  g      ?r  zwaiting for user approvalr  post_approval_responserR   rP   rr   rk  r"   rh  r   )rq  r   )r   N)r   r   r   r   r   ra  r!   r   r   r   r   r"  r'  r(  r)  tools.environments.basert  time	monotonicmaxr   waitminr   )r"   	notify_cbri  rh  rR   rP   primary_keyall_keysrn  r   r  rt  _now	_deadline_activity_staterq  
_remainingr   _outcomer   s   `                  @r    _await_gateway_decisionr    s{    	2..G##M266K##M266K  +??H=))E	 B B"";33::5AAAB B B B B B B B B B B B B B B7 7 7 7 7 7 7 (^^   J	-     J J J;SAAA!TDIIIIIIIIJ #$$(():C@@Gg,,	"   %AAAAAAA % % % $% >Ds7A&I%)D99OHP!1!11
??;CZ$8$899 	H ,!!/3NOOOP KMMM\F !)Oyy/NvvYH (^^	 	 	 	 !F333sT   2/B--B14B1#C/ /
D.9*D)#D.)D.E$ $E:9E:>F FFc                 
   |dv rdddS t          |           \  }}|r3t                              d|| dd                    t          |          S t	          |           \  }}|r3t                              d|| dd                    t          |          S t                      }t          st                      s|dk    rdddS t          d	          }t                      }	t          d
          }
|sH|	sF|
sDt          d          r0t                      dk    rt          |           \  }}}|r	dd| ddS dddS dg dd}	 ddlm}  ||           }n# t          $ r Y nw xY wt          |           \  }}}g }t!                      }|d         dv rs|                    d          pg }|r|d                             dd          nd}d| }t%          |          }t'          ||          s|                    ||df           |r(t'          ||          s|                    ||df           |sdddS |dk    rd                    d |D                       }t-          | |          }|dk    rD|D ]\  }}}t/          ||           t                              d| dd          |           ddd|d!S |dk    r)d                    d" |D                       }dd#| d$dd%S d                    d& |D                       }|d         d         }d' |D             }t3          d( |D                       }|	s|
r;d}t4          5  t6                              |          }ddd           n# 1 swxY w Y   || |||| d)} t9          ||| d*+          }!|!                    d,          rdd-||d.S |!d/         }"|!d0         }#|"r|#|#dk    r|"sd1}$d2}%d3}&nd4}$d}%d5}&dd6|$ d7|% |||&dd8S |D ]^\  }}}'|#d9k    s|#d:k    r|'rt/          ||           %|#d:k    r3t/          ||           t;          |           t=          t>                     _ddd|d;S tA          || |||d<           d|d=d| |d>| d?|  d@dAS tC          dB| ||tE          |          |dCD           tG          | || |E          }#tC          dF| ||tE          |          |dC|#G           |#dk    r	ddH||d5dd8S |D ]^\  }}}'|#d9k    s|#d:k    r|'rt/          ||           %|#d:k    r3t/          ||           t;          |           t=          t>                     _ddd|d;S )IaC  Run all pre-exec security checks and return a single approval decision.

    Gathers findings from tirith and dangerous-command detection, then
    presents them as a single combined approval request. This prevents
    a gateway force=True replay from bypassing one check when only the
    other was shown to the user.
    >   rE  rF  rG  rH  TNrh   rI  rJ  z(Sudo stdin guard block: %s (command: %s)r  rK  rN  r@   r   FrL  rM  r-  r   )actionr[  r\  r   )check_command_securityr  >   warnblockr[  rule_idunknownztirith:smartr`  c              3   "   K   | ]
\  }}}|V  d S r   rC   rN   _rd  s      r    r   z+check_all_command_guards.<locals>.<genexpr>g  s(      )J)J:1dA$)J)J)J)J)J)Jr'   r.  z'Smart approval: auto-approved '%s' (%s)r&  rb   rd   smart_approvedrP   c              3   "   K   | ]
\  }}}|V  d S r   rC   r  s      r    r   z+check_all_command_guards.<locals>.<genexpr>s  s(      -N-Nzq$d-N-N-N-N-N-Nr'   zBLOCKED by smart approval: z@. The command was assessed as genuinely dangerous. Do NOT retry.)rb   rd   smart_deniedc              3   "   K   | ]
\  }}}|V  d S r   rC   r  s      r    r   z+check_all_command_guards.<locals>.<genexpr>  s(      >>zq$d>>>>>>r'   c                     g | ]\  }}}|	S rC   rC   )rN   keyr  s      r    rQ   z,check_all_command_guards.<locals>.<listcomp>  s    ...	Q...r'   c              3   "   K   | ]
\  }}}|V  d S r   rC   )rN   r  is_ts      r    r   z+check_all_command_guards.<locals>.<genexpr>  s(      55jaDT555555r'   )rR   rr   rk  rP   r   rf  rg  rr  z?BLOCKED: Failed to send approval request to user. Do NOT retry.rR  rq  r   timed out without user response Silence is not consent.r  denied by userdeniedzBLOCKED: Command a  . The user has NOT consented to this action. Do NOT retry this command, do NOT rephrase it, and do NOT attempt the same outcome via a different command. Stop the current workflow and wait for the user to respond before taking any further destructive or irreversible action.rb   rd   rr   rP   outcomeuser_consentr  r	  rb   rd   user_approvedrP   rR   rr   rk  rP   pending_approval   ⚠️ z2. Asking the user for approval.

**Command:**
```
rP  rb   rr   rQ  approval_pendingrR   rP   rd   ro  clirp  )r   r  rv  rw  a2  BLOCKED: User denied this command. The user has NOT consented to this action. Do NOT retry this command, do NOT rephrase it, and do NOT attempt the same outcome via a different command. Stop the current workflow and wait for the user to respond before taking any further destructive or irreversible action.)$r`   r   r   rf   r\   ri   r$  r	   r   r   rD   r/  r   tools.tirith_securityr  ImportErrorr9   r   re  r   ra  r  rB  r   r   r   r   r   r  r   r   r   r   r!   r   r  )(rR   rC  r  rS  rT  is_sudo_guesssudo_guess_descapproval_moderV  rW  is_askrU  _pkrP   rY  r  rr   warningsr"   r[  r  
tirith_keytirith_desccombined_desc_for_llmverdictr  r  combined_descr  r  
has_tirithr~  ri  decisionrq  r   reasontimeout_addendumr  	is_tiriths(                                           r    check_all_command_guardsr    ss    @@@ T222 "9!A!AK 59='RVSVRV-XXX%m444 &=W%E%E"M? 9A&	7 	7 	7'888 '((M 3;== 3RWAWAW T222122F-//J.//F  3* 3V 3011 	&((F221I'1R1R.c; 
$)Kk K K K	 	 	 !T222  'B2FFM@@@@@@..w77    .Fg-N-N*L+{
 H)++K X"333 $$Z006B;CR(1+//)Y777(w((
0??;
33 	=OOZd;<<< ?;44 	?OO[+u=>>>  3 T222  $		)J)J)J)J)J J J *?@@i% 2 2	QS1111LLB "'<> > > $&*#8: : : $(II-N-NX-N-N-N$N$N!!\9N \ \ \ $	   II>>X>>>>>M1+a.K..X...H55H55555J  _
V _
	 	= 	=+//<<I	= 	= 	= 	= 	= 	= 	= 	= 	= 	= 	= 	= 	= 	= 	=   #* (, (2> M /Yy  H ||O,,  %`#.#0	    
+Hh'F v~61A1A   '>F'A$'GG-F')$&G %.F . . ,. . $/#0&$)  $ &. B B!Q	Y&&6X+=+=)+=#K5555x''#K555%c***,-@AAA !%%)-I I I
 	{&$(	%
 %
 	 	 	 &( $(m-mm_fmmm

 

 
	
 !(^^    'w;E~9JL L LF  !(^^	 	 	 	 ' '(!
 
 	
" & : :Q	Y6X#5#5)#5K----xK---c"""$%8999!-A A As$   E 
E"!E"M++M/2M/codec                 j   d}d}|dv rdddS t                      }t          st                      s|dk    rdddS t                      }t	          d          }t	          d	          r t                      d
k    r	dd||dddS dddS |s|sdddS t                      }d|  d}t          ||          rdddS |dk    rHt          ||          }	|	dk    r"t          
                    d|           ddd|dS |	d
k    r
ddd||dddS d}
t          5  t                              |          }
ddd           n# 1 swxY w Y   |
't          ||||g|d           d|dd||d| d|  ddS |||g|d}t          ||
|d          }|                    d           r	dd!||d ddS |d"         }|d#         }|r||d
k    r|sd$nd%}|sd&nd'}dd(| d)| |||sd*ndddS |d+k    rt!          ||           n9|d,k    r3t!          ||           t#          |           t%          t&                     ddd|d-S ).u  Approve an execute_code script before its child process is spawned.

    execute_code runs arbitrary local Python — the script can call
    ``subprocess``, ``os.system``, ``ctypes``, or other process/file APIs
    directly, none of which pass through ``terminal()`` /
    ``DANGEROUS_PATTERNS``. In gateway/ask contexts we fail closed by approving
    the script as a whole before it runs (#30882). Returns the same dict
    contract as ``check_all_command_guards``.

    Scope (documented limitation, #30882): in a purely local non-interactive
    non-gateway session (no TTY, not gateway, not cron-deny) this returns
    approved — matching the existing terminal auto-approve contract. The
    hardline floor still blocks catastrophic ``terminal()`` commands the script
    issues; running arbitrary code headlessly without any approval surface is
    trusted-by-config (set a gateway/ask surface or ``approvals.cron_mode`` to
    require approval).
    execute_codezexecute_code script execution. The script can spawn subprocesses or mutate files without passing through terminal command approval; approval is one-shot for this run.>   rE  rF  rG  rH  vercel_sandboxTNrh   r  rN  r@   r   Fa  BLOCKED: execute_code runs arbitrary local Python (including subprocess calls that bypass shell-string approval checks). Cron jobs run without a user present to approve it. Use normal tools instead, or set approvals.cron_mode: approve only if this cron profile is intentionally trusted.blockedr  zexecute_code <<'PY'
z
PYr  r.  z9Smart approval: auto-approved execute_code for session %sr  zkBLOCKED by smart approval: execute_code script execution was assessed as genuinely dangerous. Do NOT retry.r  )rb   rd   r  rr   rP   r  r  r  r  r  z5. Asking the user for approval.

**Code:**
```python
rP  r  rf  rg  rr  zLBLOCKED: Failed to send execute_code approval request to user. Do NOT retry.rq  r   r  r  r  r   zBLOCKED: execute_code script z. The user has NOT consented to running this code. Do NOT retry, do NOT rephrase the script, and do NOT attempt the same outcome via a different tool.r  r  r	  r  )r$  r	   r   rD   r   r/  r9   r   rB  r   r   r   r   r   r   r  r   r   r   r   )r  rC  rr   rP   r  rW  r  r"   rR   r  r~  ri  r  rq  r   r  addendums                    r    check_execute_code_guardr  "  s;   $ !K	-  RRR T222 '((M 3;== 3RWAWAW T222-//J.//F ,-- 3"$$..!0  +*$ %   !T222  3f 3 T222)++K 1d000G
 ;,, 3 T222
  +66iLLT$& & & $&*;H H Hf!, !%**# %
 
 
 I	 9 9'++K88	9 9 9 9 9 9 9 9 9 9 9 9 9 9 9  	{&(M&	%
 %
 	 	 	 &( $&5+ 5 5)-5 5 5
 
 	
 "$"	 M 'Yy  H ||O$$ 	
1&&&!
 
 	
 
#HhF 
v~6)9)9:BX22HX5=E--2- - - #+- -
 '&(0>yyh!
 
 	
 [1111	8		[111+&&& !4555 !+? ? ?s   D88D<?D<)F)NTNr   )vr   contextvarsloggingr<   rJ   r  r   ry  r|   typingr   r   r   utilsr   r   	getLoggerr   r   r=   r	   rB   __annotations__
ContextVarr   r   r   r   r!   Tokenr&   r+   tupler.   r3   r9   r>   rD   _SSH_SENSITIVE_PATH_HERMES_ENV_PATH_HERMES_CONFIG_PATH_PROJECT_ENV_PATH_PROJECT_CONFIG_PATH_SHELL_RC_FILES_CREDENTIAL_FILES_MACOS_PRIVATE_SYSTEM_PATH_SYSTEM_CONFIG_PATH_SENSITIVE_WRITE_TARGET_PROJECT_SENSITIVE_WRITE_TARGET_COMMAND_TAIL_CMDPOSHARDLINE_PATTERNS
IGNORECASEDOTALLrL   r^   rK   rY   r\   r`   r   rf   ri   DANGEROUS_PATTERNSr   rp   rq   r$   _pattern_description_legacy_key_canonical_keyr   r   ru   rW   r   r   Lockr   r   r   r   r   r   r   r   r   objectr   r   r'  r   r   r   r   r   r   r   r   r   r   r   r   r   r   r  r  r"  r$  r
  r/  rB  rX  re  r  r  r  rC   r'   r    <module>r     s          				 				 



                % % % % % % 2 2 2 2 2 2 2 2		8	$	$
 */)")4F*K*KLL 4 L L L 6L[5K6 6 6 {-c2    2H1G2 2 2 ;)#.    7Mk6L7 7 7 .s3   M3 MT M M M M88 81B31G 8 8 8 8
'[%6s%; ' ' ' ' ' 	 	 		 	 ;S!;#4S#99:		 	 	 	(+#C(+*;C*@@A(	( ( ( (: :S : : : : :>s > > > >)d ) ) ) )8 >    S J 8 
'  ? 
 /+...      	  		 
 	    #U):"T"T=Q"T"T"T +F  W J\;\W>9
 335MN!=><<>YZ""$CD+ < MBI%	  1     0M 
S U    &
S 
U 
 
 
 
      # $    $y5y,y >y f	y
 py Ay Ny 'y #y .y 1y Jy 4y  # ""$=>!y" a#y$ 2%y& 0'y0 ^1y2 d3y4 O5y6 ?7y: P;y< V=y> `?y@ mAyB 2/113RSCyD /,..0WXEyF O7NN}NNPvwGyH L4KKMKKM{|IyJ -KyT JUyV -Wy^ e_y` Wayl xmyn \oyr Osyt uuyx myyB YCyD _EyJ 6 3557_`KyL ]&E\\]\\  _B  CMyN 30224TUOyP 7!4668deQyZ H1GG4DGGGImn[y\ L"5KK8HKKKM}~]yn ]3F\\IY\\\  _O  Poyt Muyz U{y| O}y~ Uy@ TAyB :CyJ SKyf<gyn5oy z  2   I I I I I I
 -/ d3C=) . . .0 ^ ^Hl%%h//K!N##NCCEE::AA>S^B_```##K77>>^?\]]]]@s @s3x @ @ @ @c c    <3 3    Bc e    $ 		$sDy/   $& 4S> & & &#%%s3x   355 S      * * * * * * * * $&c4i % % %)+ T#v+& + + +	. 	.T 	. 	. 	. 	.
3 
4 
 
 
 
 27 # s *.;>   :6s 6t 6 6 6 6) )t ) ) ) )J J3 J J J J'S 'T ' ' ' '+c +d + + + +s t     , , , , , ,H H H H H
DS Ds Dt D D D D-3 - - - --S - - - -#    $:s : : : :  =A6:04p ps p p/2Tzp/3p :=p p p pfc    d    *C * * * *s    
 
 
 
 
,C ,c ,c , , , ,` /3e/ e/S e/C e/7;e/ e/ e/ e/X3d 3s 3 3 3 38 /8b4 b4 b4 b4 b4(+b4<@b4 b4 b4 b4L 04fA fAc fAS fA8<fA fA fA fAR	q?3 q?# q?$ q? q? q? q?j       r'   