+ WjRt^RIHt^RIt^RIt^RIt^RIHt^RIH t ]P!R4t Rs RRlt R R ltR R ltR RltRRltRRltRRltRRltRRRR/RRlltRRRRRR/RRlltR#)a(Startup security posture audit (warn-on-load, never blocks). Surfaces dangerous host / deployment posture at process start. Checks are advisory and independently fail-safe: they return human-readable strings, any internal error yields no finding, and nothing here ever raises or blocks startup. ) annotationsN)Path)Optionalzhermes.security_auditFcV^8dQhRR/#returnbool)formats"UC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\security_audit_startup.py __annotate__r s$c\\RR4;'g\\RR4pVRJ;'d V!4^8H# \dR#i;i)zCTrue when the process runs as POSIX uid 0. Always False on Windows.geteuidNgetuidF)getattros Exception)rs r _is_rootrsQ RD ) H HWR4-HFT!33fh!m3 s A A AAcV^8dQhRR/#rr Optional[str]r )r s"r r r sRR-Rrc*\4'gR#R#)Nu Running as ROOT. The agent's terminal/file tools execute with full root privileges — a single prompt-injection or exposed endpoint is a full host compromise. Run Hermes as an unprivileged user (or in a sandboxed terminal backend / container with a non-root user).)rr rr _running_as_rootrszz4R QRrcV^8dQhRR/#)rr list[str]r )r s"r r r %src.p\R4.pVP\\R4PR444VFUpVP RRR7P 4pTPR\\PT444KW V# \dLji;i \dKzi;i)z;Non-comment lines from sshd_config + its drop-in directory.z/etc/ssh/sshd_configz/etc/ssh/sshd_config.dz*.confz utf-8-sigreplaceencodingerrorsc3j"TF)q'gK VPR4'dK%VxK+ R#5i)#N) startswith).0ss& r *_iter_sshd_config_lines..2s$Y 91QQq||TWGXQQ 9s 33 3) rextendsortedglobr read_text splitlinesmapstrstrip)linespathsp raw_liness r _iter_sshd_config_linesr5%sE456E  VD!9:??IJK  [ KVVXI  YCIIy 9YY  L       s#2B!B0 B-,B-0 B?>B?cV^8dQhRR/#rr )r s"r r r 6s q qM qrcF\4pV'gR#\\P!R4PV4Uu.uF+q'gK VP ^4P 4NK- ppV'dVR,R8XdR#V'dRMRpRV R2#uupi) uWarn when sshd has password auth enabled — the classic brute-force surface, which pairs badly with a root-capable agent box. None when there is no sshd config to read. Nz#(?i)^PasswordAuthentication\s+(\w+)nou$ (default — no explicit directive)z&SSH password authentication is ENABLEDz. Password auth is brute-forceable and dangerous on an internet-facing box. Set 'PasswordAuthentication no' in sshd_config and use key-based auth.)r5r.recompilematchgrouplower)r1m directives qualifiers r _ssh_password_auth_enabledrC6s $ %E .1"**=c2d2j2jlq.rx.rvw$!''!*""$.rJxjn, &LI4YK@p pq ys  B#BcV^8dQhRR/#rr )r s"r r r Fs X Xt Xrcra\PPR4'dR#\PP R4'dR#\ R4P RRR7o\;QJdT3R lR 4F 'gK R# R#!T3R lR 44# \dR#i;i) z@Best-effort container detection (Docker / Podman / generic OCI).z /.dockerenvTHERMES_DESKTOP_CHILD_PIDFz/proc/1/cgrouputf-8rrc3,<"TF qS9xK R#5iNr )r%tokcgroups& r r' _in_container..PsW(Vf}(Vs)docker containerdkubepodslibpod) rpathexistsenvirongetrr,rany)rKs@r _in_containerrVFs ww~~m$$ zz~~011&'11791U 3W(VW33W3W3W(VW WW sB'' B65B6c V^8dQhRRRR/#)rrQrrr r )r s"r r r Ss;;4;D;rcVP4p\R4PRRR7P 4pRT4Uu.uFjp\ T4^8gK\T^,4T8Xg$\T^,4TP 9gKO\T^,4T^,3NKl ppT'gR#\TRR7^,pTR 9# \dTpLi;i \dR#i;iuupi) zTrue if *path* sits on a persistent mount per /proc/mounts, i.e. the most specific mountpoint at or above it is NOT the ephemeral container root overlay/tmpfs. z /proc/mountsrGrrTc3@"TFqP4xK R#5irI)split)r%lines& r r'#_path_is_mounted..bs6vtjjllvsc8\\V^,44#))lenr/)entrys&r "_path_is_mounted..gs#c%(m2Dr)key)overlaytmpfsaufs)resolverrr,r-r_parentsmax)rQtargetmountspartscovering best_fstypes& r _path_is_mountedroSsn%///S^^` 7v66E u:? # $U1X& 8DqNfnn<\ #eAhq"6  h$DEaHK : ::  s4C*C1D5DD C.-C.1 D?Dc V^8dQhRRRR/#)r hermes_homeOptional[Path]rrr )r s"r r r ks ; ;N ;} ;rcz\4'gR#Vf^RIHpV!4p\V4'dR#RV R2#)N)get_hermes_homez)Running in a container but the data dir (u) is NOT on a persistent volume mount — sessions, memory, skills, and API keys are ephemeral and lost on container restart. Mount a host volume over the HERMES_HOME data directory.)rVhermes_constantsrtro)rqrts& r _container_no_volume_mountrvksB ??4%'  $$7 }E: :;rc V^8dQhRRRR/#)rconfigOptional[dict]rrr )r s"r r r ys,,>,i,rc^RIHpT;'g/PR4;'g/p\V\4'dVPR4MRp\V\4'dVPR4'g.#VPR4;'g/pVPR4;'g!\ P PRR 4pVPR 4;'g!\ P PR R 4pV!\V44'd \V4P4'd.#R V R2.#)zWarn about a network-accessible API server with no API_SERVER_KEY. Read-only against config + env; overlaps the hard fail-closed guards but surfaces the posture at startup. )is_network_accessible platforms api_serverNenabledextrahostAPI_SERVER_HOSTz 127.0.0.1rcAPI_SERVER_KEYr9z4OpenAI-compatible API server is network-accessible (u) with NO API_SERVER_KEY. It dispatches terminal-capable agent work — an unauthenticated network endpoint is remote code execution. Set a strong API_SERVER_KEY.) gateway.platforms.baser{rT isinstancedictrrSr/r0)rxr{platsapirrrcs& r _network_listener_without_authrys = \\r  { + 1 1rE%/t%<%<%))L !$C sD ! !cggi&8&8 GGG  " "E 99V  N N /@+ ND ))E  B Bbjjnn-=rBC T + +s3x~~/?/? B4&I+ + ,,rrqrxc$V^8dQhRRRRRR/#)rrqrrrxryrrr )r s"r r r s"~n`ircaa.p\\V3RlV3Rl3FOpV!4p\T\4'dTP T4K4T'gK>TP T4KQ V# \dKci;i)zRun all checks and return human-readable warning strings. Pure (no logging); a check that raises simply contributes no finding. c<\S4#rI)rv)rqsr ra$run_security_audit..s HbcnHorc<\S4#rI)r)rxsr rars 8@r)rrCrrlistr)append)rqrxfindingscheckrsdd r run_security_auditrswH"$>@o@B A a   OOA  Q OOA B O    sA00 A?>A?forcec(V^8dQhRRRRRRRR/#) rrqrrrxryrr rrr )r s"r r r s,  " 3A QU  rc\'d V'g.#Rs\WR7pV'dV\PR\ V44\ V^4F&wrE\PRV\ V4V4K( V#)zZRun the audit once per process (``force=True`` re-runs) and log each finding as a warning.T)rqrxuDSecurity posture audit found %d issue(s) — review your deployment:z [security %d/%d] %s) _AUDIT_RANrloggerwarningr_ enumerate)rqrxrrifs$$$ r log_startup_security_warningsrsg z% J!kIH]_bck_lmh*DA NN2As8}a H+ Or)__doc__ __future__rloggingrr;pathlibrtypingr getLoggerrrrrr5rCrVrorvrrrr rr rs #    2 3 R" q X;0 ;,*W[$ %) DH X]  r