`gj & UdZddlmZddlZddlZddlZddlZddlmZm Z m Z m Z m Z ddl mZej eZddd d Zd ed <d Zd$dZd$dZgZded<ej2D]Zededej7dej7deej7ddddZded<ej7dZer ej>eed<ejGed%dZ$d&dZ%d'dZ&d&d Z' d( d)d!Z( d* d+d"Z)d,d#Z*y#ej@$r!Z!ejEdedee!YdZ![!dZ![!wwxYw)-usecurity-guidance plugin — fast pattern-matched security warnings on file writes. Wires one behaviour: * ``transform_tool_result`` hook — scans the *content being written* by ``write_file`` / ``patch`` / ``skill_manage`` (write/patch modes) for known dangerous code patterns (eval(, pickle.load, yaml.load, os.system, subprocess(shell=True), dangerouslySetInnerHTML, verify=False, ECB, XXE-prone XML parsers, GitHub Actions ``${{ github.event.* }}`` injection, torch.load without ``weights_only=True``, ...). When any pattern matches, the plugin appends a ``⚠️ Security warning`` block to the JSON tool-result string. The file is still written; the model sees the warning in the next turn's tool message and can self-correct. Why not block? Patterns have a non-trivial false-positive rate (``eval(`` in a tokenizer, ``yaml.load`` already wrapped in ``yaml.SafeLoader``, ECB inside a test fixture). Blocking would force every false positive into an approval prompt or an interrupted workflow. Warning is the right severity for layer 1 — the agent reads the warning and either fixes the code or briefly documents why the construct is safe. For block-mode (refuse the write entirely), set ``SECURITY_GUIDANCE_BLOCK=1``. This trades convenience for strictness and is intended for shared dev environments where unsafe-by-default patterns are policy violations. Pattern data lives in ``patterns.py``, forked verbatim from Anthropic's ``claude-plugins-official`` under Apache-2.0. See ``LICENSE`` and ``NOTICE`` in this directory. ) annotationsN)AnyDictListOptionalTuple)patterns)path)content)r ) new_stringpatch) file_path) file_contentr ) write_filer skill_managez&Dict[str, Tuple[str, Tuple[str, ...]]] _TARGET_TOOLSicbtjjddjdvS)NSECURITY_GUIDANCE_BLOCK>1onyestrueosenvirongetlowerU/root/.hermes/venv/lib/python3.12/site-packages/plugins/security-guidance/__init__.py_block_mode_enabledr#Bs' ::>>3R 8 > > @D^ ^^r!cbtjjddjdvS)NSECURITY_GUIDANCE_DISABLEr>rrrrrr r!r"_plugin_disabledr&Fs' ::>>5r : @ @ BF` ``r!zList[Dict[str, Any]] _COMPILEDruleNamereminder path_filter path_check substringsr )r(r)r*r+r,regexzDict[str, Any]_entryr-u<security-guidance: skipping rule %s — invalid regex %r: %sc|r#t|jddtkDrgSg}tD]}|j d}|' ||xsdr|j |d|df=|j d}| ||xsds^ d }|d D] }||vsd }n|s|d |d j|rd }|s|j |d|df|S#t $rYwxYw#t $rYwxYw) u Return [(ruleName, reminder), ...] for every pattern that matches. ``path`` is used by per-rule path filters (path_filter / path_check). Each rule fires at most once per call — multiple matches of the same rule collapse into a single warning entry. zutf-8ignore)errorsr+rr(r)r*Fr,Tr-)lenencode_MAX_SCAN_BYTESr'rappend Exceptionsearch)r r hitsentryr+r*matchedsubs r" _scan_contentr<hsM c'...BCoU "$D@YY|,  ! djb)KKz!2E*4E FG ii .  " "4:2./& Cg~ 5>5W~$$W-  KKz*E*,=> ??@@ K/    s$%C  C/ C,+C,/ C;:C;c2tj|}|t|tsgS|\}}|j|xsd}t|tsd}g}|D]:}|j|}t|ts%|s(|j ||f<|S)zIReturn [(path, content), ...] for a tool call. Empty if nothing to scan.r)rr isinstancedictstrr5) tool_nameargsspecpath_key content_keysr outckvals r"_extract_path_and_contentrIs   Y 'D |:dD1 !Hl 88H  #D dC !#C$hhrl c3 C JJc{ #$ Jr!c  djd|D}dddt|dt|dk7rdndd |d dg}|D]'\}}|j||jd)|jd d j|S) zBRender findings into a Markdown block appended to the tool result.z, c3&K|] \}}| yw)Nr ).0name_s r" z(_format_warning_block..s3wtQd3srz---u⚠️ Security guidance — z patternr sz matched ()zPattern matches can be false positives. If the construct is safe in this context, briefly document why in a code comment and continue. Otherwise, fix the code before moving on. )joinr2r5)findingsnameslinesrNr)s r"_format_warning_blockrWs II3(3 3E  'H hc(mWXFXs^`>aaklqkrrst  E   8 X R LL ) 99U r!ctrgSg}t||D] \}}|jt||"|S)zcCommon scan path used by both pre_tool_call (block mode) and transform_tool_result (warn mode).)r&rIextendr<)rArBrTr r s r" _scan_argsrZsF &(H29dC6 g dG456 Or!c ^tsyt||}|syddt|zdzdS)uIn block mode, refuse the write if any pattern matches. Default mode is non-blocking — we return None here and let ``transform_tool_result`` append a warning to the result instead. Nblockz&security-guidance refused this write: z7 To override, unset SECURITY_GUIDANCE_BLOCK and retry.)actionmessage)r#rZrW)rArBrNrTs r"_on_pre_tool_callr_sE  )T*H  4#H- .I J r!c tryt||}|syt|tsy t j |}t|t rd|vrt|dkry|dzt|zS#ttf$rY"wxYw)zWarn-mode hook: append a security-warning block to the tool result. Returning a string replaces the result that the model sees in the next turn. Returning None leaves the result unchanged. Nerrorz ) r#rZr>r@jsonloadsr?r2 ValueError TypeErrorrW)rArBresultrNrTparseds r"_on_transform_tool_resultris)T*H  fc " F# fd #6(9c&kQ>N F?28< <<  "   s7A66BBc\|jdt|jdty)N pre_tool_calltransform_tool_result) register_hookr_ri)ctxs r"registerros%o'89-/HIr!)returnbool)r r@r r@rpList[Tuple[str, str]])rAr@rBrrprr)rTrrrpr@)rN)rAr@rBrrNrrpzOptional[Dict[str, str]])rNN) rAr@rBrrgrrNrrpz Optional[str])rpNone)+__doc__ __future__rrcloggingrretypingrrrrrrr _patterns getLogger__name__loggerr__annotations__r4r#r&r'SECURITY_PATTERNS_rulertupler._re_srccompilera_errwarningr5r<rIrWrZr_riror r!r"rs>#  33#   8 $) .B 9 5_a#% $  ( (E*%*%yy/ii -EIIlB78 FNii G (bjj1F7OV',*Z"2   4== = = =  =<JExx  NNNj!7D    sD##E2EE