5VjK&dZddlmZddlZddlZddlZddlZddlm Z ddl m Z e e jjjdz dz Zej j#dd Zehd Zd Zej,d ej.Zej,d ej.ZddZdddZddZddZddZddZ ddZ ddZ!y)u0Hard enforcement of the NEVER rules in memory/show-on-mention.md. The show-on-mention rules used to live only in the prompt, and a prompt rule is a suggestion: "NEVER open email" is one line arguing against a hundred lines that describe, concretely, how to drive Gmail in the browser. The model rationalises ("I'm not *showing* the inbox, I'm *reading* it") and opens the page anyway. So the NEVER rules are enforced HERE, in code, as a PreToolUse gate. If a NEVER rule blocks a surface, the tool call that would open it is DENIED before it runs. The model cannot talk its way past this; the worst it can do is answer without the page, which is exactly what Ahmed asked for. Only SURFACE-OPENING tools are gated (browser navigation, app launches, shell `open`). Data tools are never touched — a NEVER rule means "don't put it on my screen", not "don't answer me", so mcp__gmail__gmail_search still works fine and Jarvis can read the inbox out loud without Chrome ever coming up. Rule format (memory/show-on-mention.md): - NEVER · "email" (say: emails, check email) → block: mail.google.com, Mail The `→ block:` clause lists what must not be opened: URL fragments and/or app names, comma-separated. A NEVER rule with no block clause can't be enforced (it stays prompt-only), so Jarvis is told to always write one. ) annotationsN)Path)Anymemoryzshow-on-mention.mdJARVIS_CHROME_CDPzhttp://127.0.0.1:9222>appbashexecgotoopenshelllaunchscrapeactivateapp_toolnavigateopen_app osascript launch_app run_script shell_tool applescript run_command browser_tabsexecute_scriptbrowser_tab_newexecute_commandbrowser_evaluatebrowser_navigatebrowser_run_code_unsafe)rrrrrruNEVER\s*·\s*"([^"]+)"zblock\s*:\s*(.+)$c. tjd}g}|jD]}|j }|j ds%t j|}tj|}|r|sT|jdjdDcgc]1}|j s|j j3}}|s|j|jd|f|S#t$rgcYSwxYwcc}w)uLive-read the enforceable NEVER rules → [(topic, [blocked patterns])]. Re-read on every call so a rule Ahmed just set ("never open gmail") is armed on his very next utterance, with no restart. zutf-8)encodingz- ,) _RULES read_textOSError splitlinesstrip startswith _TOPIC_REsearch _BLOCK_REgroupsplitlowerappend)bodyoutlinetopicblockppatss =/Users/ahmed/devFolder/Ultron/claude-voice/voice/show_gate.py never_rulesr:@s 1(*C!zz|t$   &  &E +0;;q>+?+?+DR+Da  !+DR  JJ A- ." J  SsD D6 D DDc"dkDryt|tr|jSt|tr(dj fd|j DSt|t tfrdj fd|DSy)uEVERY string in an opener's payload, as one lowercase blob. It used to read only a whitelist of keys ("url", "command", "script", …). That is a list you have to keep in sync with every MCP server's schema, and it was already out of date: macos-automator names its parameter `script_content`, not `script`, so an AppleScript that did `open location "https://mail.google.com"` produced an EMPTY blob and sailed straight through the gate. We only ever build this for a tool that can OPEN something (see `_OPENER_NAMES`), so there is no innocent field to protect: if a shell / AppleScript / navigate call mentions the blocked surface anywhere in its payload, it is about to open it. c3<K|]}t|dzywr#N_blob.0vdepths r9 z_blob..lsI5Ha+5Hc3<K|]}t|dzywr@rArCs r9rGz_blob..ns@Za+ZrH) isinstancestrr0dictjoinvalueslisttuple) tool_inputrFs `r9rBrBYsv qy*c"!!*d#xxIZ5F5F5HIII*tUm,xx@Z@@@ c|xsdjjddd}|tvxstfdtDS)zCan this tool put something on screen? Bare name (after the MCP prefix) against the known-opener set, plus a substring fallback.r=__r#c3&K|]}|v ywN)rDtnames r9rGz_is_opener..ws'J>aT >s)r0rsplit _OPENER_NAMESany_OPENER_SUBSTR) tool_namebarerZs @r9 _is_openerrarsG O " " $D ;;tQ  #D = JC'J>'J$JJrRcpd|vr||vStjdtj|d|duS)uDoes `pat` name the surface `blob` opens? A DOMAIN pattern (has a dot: mail.google.com) matches as a plain substring. A bare word (an app name: Mail) matches only on WORD BOUNDARIES — a naive substring would make "mail" match ".../email-accounts" and silently break the open-smartlead workflow. Boundaries keep "mail" off "email"/"mailchimp" while still catching "open -a Mail"..z\bN)rer,escape)patblobs r9_hitrhzs= czd{ 99299S>*"-t 4D @@rRct|syt|}|sytD] \}}|D]}t||s||fccS"y)zF(topic, pattern) if this call would open a NEVER'd surface, else None.N)rarBr:rh)r_rQrgr5r8rfs r9checkrjsO i   D "} tCCcz!% rRctDcgc]\}}|D]}|}}}}|sgS tjjtdd5}t j |}dddg}D]}|jddk7r|jdxsdjtfd |DsP tjjtd |d d5|j|jddddd|Scc}}}w#1swYxYw#t$rgcYSwxYw#1swY1xYw#t$rYwxYw) u(Close any tab in the Jarvis Chrome sitting on a NEVER'd surface. Denying browser_navigate is not enough on its own. If a Gmail tab is ALREADY open — left over from an earlier session, or resurrected by Chrome's session restore — Jarvis can put it on Ahmed's screen without navigating anywhere: select the tab, front the window, snapshot it. Worse, a tab-select tool call carries only an index, no URL, so the gate can't judge it. So we make the tab not exist. Swept before any browser action, there is nothing to select, nothing to front, nothing to show. Plain CDP HTTP (no Playwright dependency, no await): GET /json/list → GET /json/close/. Only touches the dedicated ~/.jarvis-chrome automation profile — never the real Chrome Ahmed browses in. z /json/listg?)timeoutNtypepageurlr=c36K|]}t|ywrW)rh)rDr7ros r9rGzsweep_tabs..s.A43<sz /json/close/id) r:urllibrequesturlopen_CDPjsonload Exceptiongetr0r]r1) _psr7r8rtabsclosedrYros @r9 sweep_tabsrsO '= 5=%!R"QA"A=D 5   ^^ # #tfJ$7 # E99Q>+s +s 22rR)returnzlist[tuple[str, list[str]]])r)rQrrFintrrK)r_rKrbool)rfrKrgrKrr)r_rKrQdict[str, Any]rztuple[str, str] | None)rz list[str])rrrz str | Nonerrrr)rr)"__doc__ __future__rrvrrdurllib.requestrrpathlibrtypingr__file__resolveparentr%rryru frozensetr\r^compileIr+r-r:rBrarhrjrrrrXrRr9rs.#  h   ! ( ( / /( :=Q Q zz~~)+BC   9 BJJ0"$$ 7 BJJ+RTT 2 22K A %P .D3rR