Pmj~dZddlmZddlZddlZddlmZdZdZdd Z dd Z ddZ dddZ ddZ d dZdeddd!dZdS)"a"``!`` shell mode for the interactive CLI. Typing ``!git status`` at the composer runs the command directly in the session's working directory. The model is never invoked: no user message, no assistant message, no tool result enters the conversation history, so a bang command costs zero tokens and cannot perturb role alternation or the prompt cache. A user-typed command still goes through the SAME dangerous-pattern approval gate the terminal tool uses (``tools.approval.check_all_command_guards``), reached here through ``tools.terminal_tool._check_all_guards`` so the CLI approval callback and Docker host-access handling behave identically. CLI-only by design: gateway/API/cron sessions have their own shells and no composer, so :func:`bang_shell_enabled` gates the feature off there. ) annotationsN)OptionaluZUsage: ! — run a shell command without spending a model turn (e.g. !git status)xtext Optional[str]returnboolc~t|tsdS|dS)aReturn True when *text* is a ``!`` shell-mode submission. Only a leading ``!`` (after surrounding whitespace) counts. A line that merely *contains* ``!`` mid-text (``fix the bug!``, ``echo hi!``) is an ordinary prompt and must reach the agent untouched. F! isinstancestrstrip startswith)rs ;/home/thesage/.hermes/hermes-agent/hermes_cli/bang_shell.pyis_bang_commandr s7 dC u ::<< " "3 ' ''rct|tsdS|}|dsdS|ddS)uReturn the shell command inside a bang submission (``""`` when bare). ``!ls`` → ``ls``; ``! ls -la`` → ``ls -la``; ``!!`` → ``!`` (a literal second bang is part of the command, e.g. history expansion the user's shell will handle); ``!`` alone → ``""``. r Nr )rstrippeds rparse_bang_commandr,s] dC rzz||H   s # #r ABB<    rc ddlm}n#t$rd d}YnwxYw|drdS|drdStjdpdrdSd S) aTrue only for interactive local CLI sessions. Gateway, API, and cron sessions never reach the composer and their users already have a shell; running arbitrary commands for them would be a remote-execution surface with no approving human at the keyboard. renv_var_enabledrcttj||dvS)N>1onyestrue)rosgetenvrlower)namedefaults rrz+bang_shell_enabled..env_var_enabledEs:ryw//006688>>@@D^^ ^rHERMES_GATEWAY_SESSIONFHERMES_CRON_SESSIONHERMES_SESSION_PLATFORMT)r)utilsr Exceptionr!r"rrs rbang_shell_enabledr+;s_))))))) ___ _ _ _ _ _ __/00u,--u +,,299;;u 4s   session_keyc ddlm}m}||}|r|S|pid}|r|Sn#t$rYnwxYwdS)aReturn the directory a bang command should run in. Mirrors the terminal tool's resolution order so ``!pwd`` matches where the agent's own commands land: the session's recorded ``cd`` state first (``terminal_tool.get_session_cwd``, updated after every agent command), then the configured ``TERMINAL_CWD``/backend default. ``None`` means "let the subprocess inherit the process cwd". r)_get_env_configget_session_cwdcwdN)tools.terminal_toolr.r/getr*)r,r.r/recorded configureds rresolve_bang_cwdr5Qs  HHHHHHHH"?;//  O%o''-222599          4s="= A  A commanddictcX ddlm}n#t$rdddcYSwxYw||ddS) uRun *command* through the terminal tool's approval gate. Reuses ``tools.terminal_tool._check_all_guards`` — the exact function ``terminal_tool()`` calls before executing anything — so the hardline blocklist, user deny rules, tirith findings, and the interactive dangerous-command prompt all apply to user-typed bang commands too. A command the agent would need approval for still needs approval when the user types it; ``!`` is a latency/cost shortcut, not a security bypass. Returns the gate's decision dict (``{"approved": bool, "message": ...}``). Falls back to *approved* only when the gate itself cannot be imported, which would mean a broken install rather than a policy decision. r)_check_all_guardsTN)approvedmessagelocalF)has_host_access)r1r9r*)r6r9s rcheck_bang_approvalr>hse39999999 333 T222223  Wgu E E EEs  c ddlm}|tjS#t $r!tjcYSwxYw)aEnvironment for a bang command, with Hermes-managed secrets filtered. The CLI process holds every configured provider API key in ``os.environ``. A bang command is user-typed, but it can still be a third-party script, so reuse the same sanitizer ``quick_commands`` and the local terminal backend use rather than handing the whole keyring to an arbitrary subprocess. r_sanitize_subprocess_env)tools.environments.localrAr!environcopyr*r@s r _bang_envrEsi!EEEEEE'' (9(9::: !!!z     !s,/(AA)r0timeoutwriterr0rFintc  |pd}|r>tjtj|r|nd}|rtj|} ddlm}|}n#t $rd}YnwxYw tj|dtj tj ddd|t| }n&#t $r} |d | Yd} ~ d Sd} ~ wwxYw |j (|j D] } || d !|| n#tj$r[||d |dY |j |j dSdS#t $rYdSwxYwt$$rW||dY |j |j dSdS#t $rYdSwxYwwxYw |j |j nG#t $rYn;wxYw# |j |j ww#t $rYwwxYwxYwt'|jpdS)u|Execute *command* and stream its output, returning the exit code. stdout and stderr are merged and written through *writer* (defaults to ``print``) as they arrive, so long-running commands show progress instead of buffering to the end. Nothing is returned to a caller for insertion into conversation history — the output exists only on the user's terminal. cRt||drdndS)N r)end)printendswith)lines rz"run_bang_command..s)5t9L9L3V22RV#W#W#WrNr)windows_hide_flagsTzutf-8replace) shellstdoutstderrrencodingerrorsr0env creationflagsz!: failed to run command: rK)rFz!: command timed out after s|z!: interrupted)r!pathisdir expanduserhermes_cli._subprocess_compatrQr* subprocessPopenPIPESTDOUTrErTrstripwaitTimeoutExpiredkillcloseKeyboardInterruptrH returncode) r6r0rFrGemitrun_cwdrQrYprocexcrOs rrun_bang_commandrqsY  XWWDObgmmBG,>,>s,C,CDDOcc4G.'$$W--DDDDDD**,,   ?$ '       /# / /000sssss ; "  ( (T[[&&'''' ' """"  $   57 5 5 5666 {& !!#####'&    DD      {& !!#####'&    DD  # {& !!###    D  {& !!####'    D  t#! $ $$s*A;; B  B >C C0C++C04AD:9H9:2H,H9. F F F #(H H9 G11 G?>G?HH9 H)) H65H69I-; II- I*'I-)I**I-)rrrr )rrrr)rr )N)r,rrr)r6rrr7)rr7)r6rr0rrFrHrrH)__doc__ __future__rr!rbtypingr USAGE_HINTDEFAULT_TIMEOUTrrr+r5r>rErqrrrxs"#"""""  i  ( ( ( (     ,.FFFF0 ! ! ! !&"  C%C%C%C%C%C%C%C%r