i bUdZddlZddlZddlZddlZddlZddlZddlZddlZddl m Z ddl m Z ddl mZejeZejddZejeed <d ed dfd Zd ed ejefdZdejed dfdZdded efdZdZdZdZdZdededZdededZ dZ!dZ"dddd d!d"d#d$e"d%zd&fe"d'zd(fe"d)zd*fe"d+zd,fg Z#ej$ej%zZ&d-e#DZ'd.ed e(fd/Z)d0ed e*fd1Z+gd2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBd#dCdDdEdFdGedHfdIedJfdGe dKe!dLfdIe dKe!dMfdNdOdPdQdRdSdTdUdVdWdXdYe dKe!dZfd[d\d]d^d_d`dadbdcZ,dde,DZ-deed efdfZ.iZ/e*ee0efedg<e,D]x\Z1Z2e.e1Z3e2Z4e/5e4e06e4e3he/5e3e06e3e4hydhed e0efdiZ7d.ed efdjZ8d.ed e(fdkZ9ej:Z;iZe0eedn<e0Z?e0edo<GdpdqZ@iZAe*eeBfedr<iZCe*eeDfeds<d ed dfdtZEd ed dfduZF dd edwedxeGd eHfdyZId ed eGfdzZJd ed{e*fd|ZKd edhefd}ZLd ed dfd~ZMd ed dfdZNd ed dfdZOd ed eGfdZPd eGfdZQd edhed eGfdZRdhefdZSde0fdZTd e0fdZUde0fdZV dd.ed0edeHdzdeGd ef dZWd efdZXd e*fdZYd efdZZd eHfdZ[d efdZ\d.ed0ed efdZ] dd.eded e*fdZ^de*d efdZ_ dd.eded e*fdZ`eUdS)aDangerous command approval -- detection, prompting, and per-session state. This module is the single source of truth for the dangerous command system: - Pattern detection (DANGEROUS_PATTERNS, detect_dangerous_command) - Per-session approval state (thread-safe, keyed by session_key) - Approval prompting (CLI interactive + gateway async) - Smart approval via auxiliary LLM (auto-approve low-risk commands) - Permanent allowlist persistence (config.yaml) N)Optional)cfg_get)is_truthy_valueapproval_session_keydefault_approval_session_key hook_namereturnc ddlm}n#t$rYdSwxYw ||fi|dS#t$r'}td||Yd}~dSd}~wwxYw)a{Invoke a plugin lifecycle hook for the approval system. Lazy-imports the plugin manager to avoid circular imports (approval.py is imported very early, long before plugins are discovered). Never raises -- plugin errors are logged and swallowed. Only fires for the two approval-specific hooks in VALID_HOOKS: pre_approval_request, post_approval_response. r) invoke_hookNz$Approval hook %s dispatch failed: %s)hermes_cli.pluginsr Exceptionloggerdebug)r kwargsrexcs 3/home/ubuntu/.hermes/hermes-agent/tools/approval.py_fire_approval_hookr$s2222222  M I((((((( MMM  ;YLLLLLLLLL Ms   & AAA session_keyc:t|pdS)zs $ $[%6B 7 77tokenc:t|dS)z/Restore the prior approval session key context.N)r reset)rs rreset_current_session_keyr Cs&&&&&rr c`t}|r|Sddlm}|d|S)a Return the active session key, preferring context-local state. Resolution order: 1. approval-specific contextvars (set by gateway before agent.run) 2. session_context contextvars (set by _set_session_env) 3. os.environ fallback (CLI, cron, tests) r)get_session_envHERMES_SESSION_KEY)r getgateway.session_contextr")r rr"s rget_current_session_keyr&HsH(++--K777777 ?/ 9 99rz$(?:~|\$home|\$\{home\})/\.ssh(?:/|$)z\(?:~\/\.hermes/|(?:\$home|\$\{home\})/\.hermes/|(?:\$hermes_home|\$\{hermes_home\})/)\.env\bz;(?:(?:/|\.{1,2}/)?(?:[^\s/"\'`]+/)*\.env(?:\.[^/\s"\'`]+)*)z0(?:(?:/|\.{1,2}/)?(?:[^\s/"\'`]+/)*config\.yaml)z(?:/etc/|/dev/sd||)z(?:z(?:\s*(?:&&|\|\||;).*)?$zp(?:^|[;&|\n`]|\$\()\s*(?:sudo\s+(?:-[^\s]+\s+)*)?(?:env\s+(?:\w+=\S*\s+)*)?(?:(?:exec|nohup|setsid|time)\s+)*\s*)z&\brm\s+(-[^\s]*\s+)*(/|/\*|/ \*)(\s|$)z#recursive delete of root filesystem)z\brm\s+(-[^\s]*\s+)*(/home|/home/\*|/root|/root/\*|/etc|/etc/\*|/usr|/usr/\*|/var|/var/\*|/bin|/bin/\*|/sbin|/sbin/\*|/boot|/boot/\*|/lib|/lib/\*)(\s|$)z$recursive delete of system directory)z-\brm\s+(-[^\s]*\s+)*(~|\$HOME)(/?|/\*)?(\s|$)z"recursive delete of home directory)z\bmkfs(\.[a-z0-9]+)?\bzformat filesystem (mkfs))z9\bdd\b[^\n]*\bof=/dev/(sd|nvme|hd|mmcblk|vd|xvd)[a-z0-9]*zdd to raw block device)z.>\s*/dev/(sd|nvme|hd|mmcblk|vd|xvd)[a-z0-9]*\bzredirect to raw block device)z(:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:z fork bomb)z\bkill\s+(-[^\s]+\s+)*-1\bkill all processesz!(shutdown|reboot|halt|poweroff)\bzsystem shutdown/rebootz init\s+[06]\bzinit 0/6 (shutdown/reboot)z*systemctl\s+(poweroff|reboot|halt|kexec)\bzsystemctl poweroff/rebootztelinit\s+[06]\bztelinit 0/6 (shutdown/reboot)cLg|]!\}}tj|t|f"Srecompile _RE_FLAGS.0pattern descriptions r r4s=Z##[1rcommandct|}tD] \}}||rd|fcS!dS)zCheck if a command matches the unconditional hardline blocklist. Returns: (is_hardline, description) or (False, None) T)FN) _normalize_command_for_detectionlowerHARDLINE_PATTERNS_COMPILEDsearch)r5 normalized pattern_rer3s rdetect_hardline_commandr=sb 2'::@@BBJ#='' K   Z ( ( '+& & & & ' =rr3cddd|ddS)z5Build the standard block result for a hardline match.FTzBLOCKED (hardline): u. This command is on the unconditional blocklist and cannot be executed via the agent — not even with --yolo, /yolo, approvals.mode=off, or cron approve mode. If you genuinely need to run it, run it yourself in a terminal outside the agent.)approvedhardlinemessager+)r3s r_hardline_block_resultrBs/ ;      r)z\brm\s+(-[^\s]*\s+)*/zdelete in root path)z\brm\s+-[^\s]*rzrecursive delete)z\brm\s+--recursive\bzrecursive delete (long flag))z8\bchmod\s+(-[^\s]*\s+)*(777|666|o\+[rwx]*w|a\+[rwx]*w)\bz world/other-writable permissions)z8\bchmod\s+--recursive\b.*(777|666|o\+[rwx]*w|a\+[rwx]*w)z*recursive world/other-writable (long flag))z\bchown\s+(-[^\s]*)?R\s+rootzrecursive chown to root)z\bchown\s+--recursive\b.*rootz#recursive chown to root (long flag))z\bmkfs\bzformat filesystem)z \bdd\s+.*if=z disk copy)z >\s*/dev/sdzwrite to block device)z\bDROP\s+(TABLE|DATABASE)\bzSQL DROP)z \bDELETE\s+FROM\b(?!.*\bWHERE\b)zSQL DELETE without WHERE)z\bTRUNCATE\s+(TABLE)?\s*\wz SQL TRUNCATE)z >\s*/etc/zoverwrite system config)z8\bsystemctl\s+(-[^\s]+\s+)*(stop|restart|disable|mask)\bzstop/restart system service)z\bkill\s+-9\s+-1\br))z\bpkill\s+-9\bzforce kill processes)z%\b(bash|sh|zsh|ksh)\s+-[^\s]*c(\s+|$)zshell command via -c/-lc flag)z)\b(python[23]?|perl|ruby|node)\s+-[ec]\s+zscript execution via -e/-c flag)z\b(curl|wget)\b.*\|\s*(ba)?sh\bzpipe remote content to shell)z1\b(bash|sh|zsh|ksh)\s+<\s*>?\s*["\']?z%overwrite system file via redirectionz["\']?z$overwrite project env/config via teez,overwrite project env/config via redirection)z\bxargs\s+.*\brm\bz xargs with rm)z\bfind\b.*-exec\s+(/\S*/)?rm\bz find -exec rm)z\bfind\b.*-delete\bz find -delete)z%\bhermes\s+gateway\s+(stop|restart)\bz2stop/restart hermes gateway (kills running agents))z\bhermes\s+update\bz6hermes update (restarts gateway, kills running agents))z4gateway\s+run\b.*(&\s*$|&\s*;|\bdisown\b|\bsetsid\b)Mstart gateway outside systemd (use 'systemctl --user restart hermes-gateway'))z\bnohup\b.*gateway\s+run\brC)z1\b(pkill|killall)\b.*\b(hermes|gateway|cli\.py)\bz.kill hermes/gateway process (self-termination))z\bkill\b.*\$\(\s*pgrep\bz3kill process via pgrep expansion (self-termination))z\bkill\b.*`\s*pgrep\bz44 K   ] + + 4%K+{3 3 3 3 4  r_pending_session_approved _session_yolo_permanent_approvedc"eZdZdZdZdefdZdS)_ApprovalEntryz@One pending dangerous-command approval inside a gateway session.)eventdataresultrbcRtj|_||_d|_dSN) threadingEventrarbrc)selfrbs r__init__z_ApprovalEntry.__init__vs#_&&  %) rN)__name__ __module__ __qualname____doc__ __slots__dictrir+rrr`r`rs:JJ+I*T******rr`_gateway_queues_gateway_notify_cbscZt5|t|<ddddS#1swxYwYdS)uaRegister a per-session callback for sending approval requests to the user. The callback signature is ``cb(approval_data: dict) -> None`` where *approval_data* contains ``command``, ``description``, and ``pattern_keys``. The callback bridges sync→async (runs in the agent thread, must schedule the actual send on the event loop). N)_lockrq)rcbs rregister_gateway_notifyrusy ..+-K(.................. $$ct5t|dt|g}dddn #1swxYwY|D]}|jdS)zUnregister the per-session gateway approval callback. Signals ALL blocked threads for this session so they don't hang forever (e.g. when the agent run finishes or is interrupted). N)rsrqpoprprarrentriesentrys runregister_gateway_notifyr|s 77 T222!%%k266777777777777777 s7A  AAFchoice resolve_allct5t|}|s ddddS|r$t|}|n|dg}|st|ddddn #1swxYwY|D]"}||_|j#t|S)aTCalled by the gateway's /approve or /deny handler to unblock waiting agent thread(s). When *resolve_all* is True every pending approval in the session is resolved at once (``/approve all``). Otherwise only the oldest one is resolved (FIFO). Returns the number of approvals resolved (0 means nothing was pending). Nr) rsrpr$listclearrxrcrarlen)rr}r~queuetargetsr{s rresolve_gateway_approvalrs1  3 3##K00  3 3 3 3 3 3 3 3  %5kkG KKMMMMyy||nG 3    T 2 2 2 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3   w<<sBABBBct5tt|cdddS#1swxYwYdS)zFCheck if a session has one or more blocking gateway approvals waiting.N)rsboolrpr$rs rhas_blocking_approvalrs 66O'' 4455666666666666666666s'<AAapprovalcZt5|t|<ddddS#1swxYwYdS)z/Store a pending approval request for a session.N)rsr[)rrs rsubmit_pendingrsv )) ())))))))))))))))))rvct5t|t|ddddS#1swxYwYdS)z(Approve a pattern for this session only.N)rsr\ setdefaultradd)rrKs rapprove_sessionrs JJ$$[#%%88<<[IIIJJJJJJJJJJJJJJJJJJs;AAAc|sdSt5t|ddddS#1swxYwYdS)z,Enable YOLO bypass for a single session key.N)rsr]rrs renable_session_yolors  ''+&&&'''''''''''''''''' 488c|sdSt5t|ddddS#1swxYwYdS)z-Disable YOLO bypass for a single session key.N)rsr]discardrs rdisable_session_yolors  ++k***++++++++++++++++++rcl|sdSt5t|dt|t |dt |g}dddn #1swxYwY|D]"}d|_|j #dS)z7Remove all approval and yolo state for a given session.Ndeny) rsr\rxr]rr[rprcrarrys r clear_sessionrs  77k4000k*** [$'''!%%k266 777777777777777    sA,BB Bc^|sdSt5|tvcdddS#1swxYwYdS)z?Return True when YOLO bypass is enabled for a specific session.FN)rsr]rs ris_session_yolo_enabledrs u ,,m+,,,,,,,,,,,,,,,,,,s "&&c<ttdS)zEReturn True when the active approval session has YOLO bypass enabled.rr)rr&r+rris_current_session_yolo_enabledrs "#:2#F#F#F G GGrc6t|}t5td|Dr ddddSt|t tfd|DcdddS#1swxYwYdS)zCheck if a pattern is approved (session-scoped or permanent). Accept both the current canonical key and the legacy regex-derived key so existing command_allowlist entries continue to work after key migrations. c3(K|] }|tvVdSre)r^)r1aliass r zis_approved..s(AAu++AAAAAArNTc3 K|]}|vV dSrer+)r1rsession_approvalss rrzis_approved..s)CC%5--CCCCCCr)rNrsanyr\r$r)rrKaliasesrs @r is_approvedrs $K00G DD AAAAA A A DDDDDDDD.11+suuEECCCC7CCCCC DDDDDDDDDDDDDDDDDDsBABBBczt5t|ddddS#1swxYwYdS)z)Add a pattern to the permanent allowlist.N)rsr^rrMs rapprove_permanentrs -- ,,,------------------ 044patternsczt5t|ddddS#1swxYwYdS)z2Bulk-load permanent allowlist entries from config.N)rsr^update)rs rload_permanentr s --""8,,,------------------rc ddlm}|}t|dgpg}|rt ||S#t $r3}t d|tcYd}~Sd}~wwxYw)zLoad permanently allowed command patterns from config. Also syncs them into the approval module so is_approved() works for patterns added via 'always' in a previous session. r load_configcommand_allowlistz&Failed to load permanent allowlist: %sN)hermes_cli.configrrr$rrrwarning)rconfigres rload_permanent_allowlistrs 111111vzz"5r::@bAA  % 8 $ $ $ ?CCCuu sAA B(B<BBc ddlm}m}|}t||d<||dS#t$r&}t d|Yd}~dSd}~wwxYw)z4Save permanently allowed command patterns to config.r)r save_configrzCould not save allowlist: %sN)rrrrrrr)rrrrrs rsave_permanent_allowlistr&s:>>>>>>>>&*8nn"# F :::5q999999999:s/3 A#AA#Ttimeout_secondsallow_permanentc |t}|D |||S#t$r(}td|dYd}~dSd}~wwxYw ddlm}|td ||dSn#t$rYnwxYwd tjd < ttd |td |trtdntdttj ddi  fd}tj|d}||||rYtd d tjvr tjd =ttj dS d} | dvrYtd d tjvr tjd =ttj dS| dvrYtd d tjvr tjd =ttj dS| dvrsYtd d tjvr tjd =ttj dStd d tjvr tjd =ttj dStd d tjvr tjd =ttj dS#t$t&f$rZtd Yd tjvr tjd =ttj dSwxYw#d tjvr tjd =ttj wxYw)!aPrompt the user to approve a dangerous command (CLI only). Args: allow_permanent: When False, hide the [a]lways option (used when tirith warnings are present, since broad permanent allowlisting is inappropriate for content-level security findings). approval_callback: Optional callback registered by the CLI for prompt_toolkit integration. Signature: (command, description, *, allow_permanent=True) -> str. Returns: 'once', 'session', 'always', or 'deny' N)rzApproval callback failed: %sT)exc_inforr)get_app_or_nonezDangerous-command approval requested on a thread with no approval callback while prompt_toolkit is active; denying to avoid stdin deadlock. command=%r description=%r1HERMES_SPINNER_PAUSEu ⚠️ DANGEROUS COMMAND: z z2 [o]nce | [s]ession | [a]lways | [d]enyz% [o]nce | [s]ession | [d]enyr}rc rdnd}t|d<dS#ttf$r dd<YdSwxYw)Nz Choice [o/s/a/D]: z Choice [o/s/D]: r}r)inputstripr8EOFErrorOSError)promptrrcs r get_inputz,prompt_dangerous_approval..get_input{sz*;Jh77PhF',V}}':':'<'<'B'B'D'DF8$$$ '****')F8$$$$*s>> GGG J     ^F * * * * * *%YtDDDF LLNNN KKK 0 0 0   =>>>. "RZ / / 12  1H%F&&.///$ "RZ / / 12  )+++:;;;  "RZ / / 12  #?**&%>???$ "RZ / / 12  >??? "RZ / / 12  ())) "RZ / / 12   ' ( %&&& !RZ / / 12   "RZ / / 12  sj $ AAA,B BB)C;O.OO0OO(O P,!P/+P,,P//A Q8ct|tr|durdndSt|tr*|}|pdSdS)a"Normalize approval mode values loaded from YAML/config. YAML 1.1 treats bare words like `off` as booleans, so a config entry like `approvals: mode: off` is parsed as False unless quoted. Treat that as the intended string mode instead of falling back to manual approvals. Foffmanual) isinstancerstrrr8)moder;s r_normalize_approval_modersc$4 uu83$&ZZ\\'')) %X% 8rc ddlm}|}|dipiS#t$r'}td|icYd}~Sd}~wwxYw)zLRead the approvals config block. Returns a dict with 'mode', 'timeout', etc.rr approvalsz"Failed to load approval config: %sN)rrr$rrr)rrrs r_get_approval_configrs111111zz+r**0b0 ;Q??? s'* AAAAcdtdd}t|S)zHRead the approval mode from config. Returns 'manual', 'smart', or 'off'.rr)rr$r)rs r_get_approval_moders+  ! ! % %fh 7 7D #D ) ))rc ttddS#ttf$rYdSwxYw)z>Read the approval timeout from config. Defaults to 60 seconds.r<)intrr$ ValueError TypeErrorr+rrrrsS'))--i<<===  "rrs.1AAc ddlm}|}tt|ddd}|dvrdSdS#t $rYdSwxYw) zERead the cron approval mode from config. Returns 'deny' or 'approve'.rrr cron_moderr)approverallowyesr)rrrrr8rr)rrrs r_get_cron_approval_moders11111176; VLLLMMSSUU[[]] 5 5 59v vvsAA A,+A,cD ddlm}d|d|d}|dd|dgdd }|jdjjpd }d |vrd Sd|vrdSdS#t$r&}t d|Yd}~dSd}~wwxYw)aUse the auxiliary LLM to assess risk and decide approval. Returns 'approve' if the LLM determines the command is safe, 'deny' if genuinely dangerous, or 'escalate' if uncertain. Inspired by OpenAI Codex's Smart Approvals guardian subagent (openai/codex#13860). r)call_llmzYou are a security reviewer for an AI coding agent. A terminal command was flagged by pattern matching as potentially dangerous. Command: z Flagged reason: ul Assess the ACTUAL risk of this command. Many flagged commands are false positives — for example, `python -c "print('hello')"` is flagged as "script execution via -c flag" but is completely harmless. Rules: - APPROVE if the command is clearly safe (benign script execution, safe file operations, development tools, package installs, git operations, etc.) - DENY if the command could genuinely damage the system (recursive delete of important paths, overwriting system files, fork bombs, wiping disks, dropping databases, etc.) - ESCALATE if you're uncertain Respond with exactly one word: APPROVE, DENY, or ESCALATEruser)rolecontent)taskmessages temperature max_tokensrAPPROVErDENYrescalatez1Smart approvals: LLM call failed (%s), escalatingN) agent.auxiliary_clientrchoicesrArrupperrrr)r5r3rrresponseanswerrs r_smart_approver s#333333 =  = = = = =8%&99:    "1%-5;BBDDJJLL   9 v  6:  H!LLLzzzzzsA#A/'A// B9BBenv_typec |dvrdddSt|\}}|r3td||ddt|St t jdstrdddSt|\}}}|sdddSt}t||rdddSt jd} t jd } | s6| s4t jd rtd kr d d |ddSdddS| st jdr$t||||dd |d||d|d|ddSt|||} | d kr d d|d||dS| dkrt||n9| dkr3t||t|t!t"dddS)aCheck if a command is dangerous and handle approval. This is the main entry point called by terminal_tool before executing any command. It orchestrates detection, session checks, and prompting. Args: command: The shell command to check. env_type: Terminal backend type ('local', 'ssh', 'docker', etc.). approval_callback: Optional CLI callback for interactive prompts. Returns: {"approved": True/False, "message": str or None, ...} docker singularitymodaldaytonavercel_sandboxTNr?rA Hardline block: %s (command: %s)HERMES_YOLO_MODEHERMES_INTERACTIVEHERMES_GATEWAY_SESSIONHERMES_CRON_SESSIONrF'BLOCKED: Command flagged as dangerous () but cron jobs run without a user present to approve it. Find an alternative approach that avoids this command. To allow dangerous commands in cron jobs, set approvals.cron_mode: approve in config.yaml.HERMES_EXEC_ASK)r5rKr3approval_requiredu.⚠️ This command is potentially dangerous (z3). Asking the user for approval. **Command:** ```  ```r?rKstatusr5r3rA)rzBBLOCKED: User denied this potentially dangerous command (matched 'zL' pattern). Do NOT retry this command - the user has explicitly rejected it.r?rArKr3rr)r=rrrBrrgetenvrrZr&rrrrrrrr^) r5r r is_hardline hardline_desc is_dangerousrKr3ris_cli is_gatewayr}s rcheck_dangerous_commandr) sRRR T222"9!A!AK59='RVSVRV-XXX%m444ry!3445539X9Z9Z3 T222-Eg-N-N*L+{ 3 T222)++K; ,,3 T222 Y+ , ,F344J 3*3 9* + + &((F22 %G+GGG   !T222 RY011 {&&% %    &)&VVVGNVVV   'w 9JLLLFv\gvvv&&     [1111 8   [111+&&& !4555 . ..r tirith_resultc |dpg}|s|dpd}d|Sg}|D]}|dd}|dd}|dd}|r*|r(||r d |d |d |n|d |p|r||rd |d |n||s|dpd}d|Sd d |zS)zBuild a human-readable description from tirith findings. Includes severity, title, and description for each finding so users can make an informed approval decision. findingssummaryzsecurity issue detectedzSecurity scan: severityrtitler3[z] z: uSecurity scan — ; )r$appendr)r*r,r-partsfr.r/descs r_format_tirith_descriptionr6pso   ,,2H +##I..K2K**** E II55R((gr""uu]B''  IT I LLH\8X8888$888UJ\J\VZJ\J\ ] ] ] ]  I LLHG0X00000% H H H +##I..K2K**** $))E"2"2 22rc L|dvrdddSt|\}}|r3td||ddt|St }t t jdsts|dkrdddSt jd }t jd }t jd }|sM|sK|sIt jd r0td krt|\} } } | r dd| ddSdddSdgdd} ddl m } | |} n#t$rYnwxYwt|\} }} g}t}| ddvrs| dpg}|r|dddnd}d|}t!| }t#||s|||df| r(t#||s||| df|sdddS|dkrdd|D}t)||}|dkrD|D]\}}}t+||td |dd!|ddd|d"S|d kr)dd#|D}dd$|d%dd&Sdd'|D}|dd}d(|D}t/d)|D}|s|rd}t05t2|}dddn #1swxYwY|P||||d*}t5|}t05t6|g|dddn #1swxYwYt;d+|||t=||d,- ||n#t>$r} td.| t05t6|g}!||!vr|! ||!st6!|ddddn #1swxYwYdd/||d0cYd} ~ Sd} ~ wwxYwtEd1d2}" tG|"}"n#tHtJf$rd2}"YnwxYw dd3l&m'}#n#t>$rd}#YnwxYwtQj)}$|$tU|"dz}%|$|$d4}&d}' |%tQj)z }(|(dkrn;|j+,t[d5|(6rd}'n|# |#|&d7Xt05t6|g}!||!vr|! ||!st6!|ddddn #1swxYwY|j.})|'sd8n|)r|)nd8}*t;d9|||t=||d,|*:|'r|)|)d kr|'sd;nd<}+dd=|+d>||d0S|D]^\}}},|)d?ks|)d@kr|,rt+||%|)d@kr3t+||t_|tatb_ddd|dASte|||||d*d|dB||dC|dD|dEdFSt;d+|||t=||dG-tg||| |H})t;d9|||t=||dG|):|)d krddI||d0S|D]^\}}},|)d?ks|)d@kr|,rt+||%|)d@kr3t+||t_|tatb_ddd|dAS)JaCRun all pre-exec security checks and return a single approval decision. Gathers findings from tirith and dangerous-command detection, then presents them as a single combined approval request. This prevents a gateway force=True replay from bypassing one check when only the other was shown to the user. rTNrrrrrrrrrrFrrrr)actionr,r-r)check_command_securityr8)blockwarnr,rule_idunknownztirith:smartr1c3"K|] \}}}|V dSrer+r1_r5s rrz+check_all_command_guards..s()J)J:1dA$)J)J)J)J)J)Jrrz'Smart approval: auto-approved '%s' (%s)r)r?rAsmart_approvedr3c3"K|] \}}}|V dSrer+r@s rrz+check_all_command_guards..s(-N-Nzq$d-N-N-N-N-N-NrzBLOCKED by smart approval: z@. The command was assessed as genuinely dangerous. Do NOT retry.)r?rA smart_deniedc3"K|] \}}}|V dSrer+r@s rrz+check_all_command_guards..s(>>zq$d>>>>>>rcg|]\}}}| Sr+r+)r1keyrAs rr4z,check_all_command_guards..s... Q...rc3"K|] \}}}|V dSrer+)r1rAis_ts rrz+check_all_command_guards.. s(55jaDT555555r)r5rK pattern_keysr3pre_approval_requestgateway)r5r3rKrJrsurfacez"Gateway approval notify failed: %sz?BLOCKED: Failed to send approval request to user. Do NOT retry.r"gateway_timeouti,)touch_activity_if_due) last_touchrg?rzwaiting for user approvalrpost_approval_response)r5r3rKrJrrMr}z timed outzdenied by userzBLOCKED: Command z. Do NOT retry this command.rr)r?rA user_approvedr3ru⚠️ z2. Asking the user for approval. **Command:** ``` rr cli)rrz#BLOCKED: User denied. Do NOT retry.)4r=rrrBrrrr#rrrZtools.tirith_securityr9 ImportErrorr&r$r6rr2rr rrrrsrqr`rprrrrremoverxrrrrtools.environments.baserOtime monotonicmaxrawaitminrcrrr^rr)-r5r rr$r% approval_moder'r(is_askr&_pkr3r*r9rKwarningsrr,r< tirith_key tirith_desccombined_desc_for_llmverdictrGrA combined_desc primary_keyall_keys has_tirith notify_cb approval_datar{rrrrO_now _deadline_activity_stateresolved _remainingr}_outcomereason is_tiriths- rcheck_all_command_guardsrss RRR T222 "9!A!AK59='RVSVRV-XXX%m444'((Mry!3445539X9Z9Z3^kot^t^t T222 Y+ , ,F344J Y( ) )F 3*3V3 9* + + &((F221I'1R1R. c; $)KkKKK   !T222 'B2FFM @@@@@@..w77      .Fg-N-N*L+{ H)++K X"333 $$Z006B;CR(1+//)Y777(w(( 0?? ; 33 = OOZd; < < <?; 44 ? OO[+u= > > > 3 T222  $ )J)J)J)J)J J J *?@@ i  % 2 2 Q S1111 LLB "'< > > > $&*#8:: :  $(II-N-NX-N-N-N$N$N !!\9N\\\ $  II>>X>>>>>M1+a.K..X...H55H55555J [ V[   = =+// <>> ???????????????!&`#.#0  .+,,001BCHHG g,, *     -IIIIIII - - -(,%%% ->##Ds7A.I-1DAAOH &)9)99 ??;##CZ,@,@#AA#H(4))')D   ; ;'++K<<E>>LL''';#'' T:::  ; ; ; ; ; ; ; ; ; ; ; ; ; ; ;\F "*7 &5ffI  ()'!(^^'!     v~61A1A,4J:J %W6WWW#.#0 &. B B!Q Y&&6X+=+=)+=#K5555x''#K555%c***,-@AAA!%%)-II I {&$( % %    &)(m-mm_fmmm   !(^^'w ;E~9JLLLF !(^^    <&(    &::Q Y  6X#5#5)#5 K - - - - x   K - - - c " " " $%8 9 9 9!- A AAs+D== E  E ,MMM>/N99N=N=( O44 R>"R AQ>2 R>R RR  RRRSS&%S&*S11 T?TAW..W25W2)F)NTNre)arm contextvarsloggingrr-rrfrXrUtypingrrrutilsr getLoggerrjr ContextVarr r__annotations__rTokenrr r&_SSH_SENSITIVE_PATH_HERMES_ENV_PATH_PROJECT_ENV_PATH_PROJECT_CONFIG_PATH_SENSITIVE_WRITE_TARGET_PROJECT_SENSITIVE_WRITE_TARGET _COMMAND_TAIL_CMDPOSHARDLINE_PATTERNS IGNORECASEDOTALLr/r9tupler=rorBDANGEROUS_PATTERNSrXrIrJr_pattern _description _legacy_key_canonical_keyrrrNr7rZLockrsr[r\r]r^r`rprrqobjectrur|rrrrrrrrrrrrrrrrrrrrrrr r)r6rsr+rrrs   %%%%%%!!!!!!  8 $ $ 6L[5K 666{-c2 M3MTMMMM4881B31G8888 '[%6s%;''''' : :S : : : : : > SJ #U):"T"T=Q"T"T"T+ F WJ\;\W>9  335MN !=> <<>YZ ""$CD+< MBI %  1 S U          (B5B,B>Bf B p B A BNB'B#B.B1BFB4B.BaB 2!B"0#B$?%B(P)B*V+B,I-B.m/B02/113RS1B2/,..0WX3B4O7NN}NNPvw5B6L4KKMKKM{|7B8-9B:9;B<-=BDeEBFWGBJOKBLuMBPmQBZY[B\_]B`CaBb]&E\\]\\_BCcBdEeBfUgBlMmBrUsBtOuBvUwBxTyBz:{BBSCBL 2 IIIIII -/d3C=)...0^^Hl%%h//K!N##NCCEE::AA>S^B_```##K77>> ^?\]]]]@s@s3x@@@@cc$ c e    $  $sDy/$&4S>&&&#%% s3x355S ********$&c4i%%%)+T#v+&+++ . .T . . . . 3 4    27#s*.;>:6s6t6666 ))t)))) JJ3JJJJ 'S'T''''+c+d++++ s t     ,,,,,,HHHHH DS Ds Dt D D D D-3---- -S----#$:s:::: =A6:04mmsmm/2Tzm/3m:=mmmm` c    d*C**** s     ,C,c,c,,,,`/3`/`/S`/C`/7;`/`/`/`/N3d3s3333804NANAcNASNA8<NANANANAd r