@clawpump/claw-agent 0.1.4 → 0.1.6

package/agent/hermes_cli/win_pty_bridge.py

@@ -0,0 +1,179 @@
+"""Windows ConPTY bridge for the `hermes dashboard` chat tab.
+
+Drop-in counterpart to ``hermes_cli.pty_bridge.PtyBridge`` for native
+Windows. Mirrors the exact public surface the ``/api/pty`` WebSocket
+handler in ``hermes_cli.web_server`` consumes: ``spawn``, ``read``,
+``write``, ``resize``, ``close``, ``is_available``, plus the
+``PtyUnavailableError`` type.
+
+Backed by ``pywinpty`` (already a declared win32 dependency in
+pyproject.toml) instead of ``ptyprocess``/``fcntl``/``termios``, none of
+which exist on native Windows. The read/write/terminate calls here match
+the working winpty usage already shipping in ``tools/process_registry.py``.
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+import time
+from typing import Optional, Sequence
+
+try:
+    from winpty import PtyProcess  # type: ignore
+    _PTY_AVAILABLE = sys.platform.startswith("win")
+except ImportError:  # pragma: no cover - non-Windows or pywinpty missing
+    PtyProcess = None  # type: ignore
+    _PTY_AVAILABLE = False
+
+
+__all__ = ["WinPtyBridge", "PtyUnavailableError"]
+
+
+# Same clamp ceiling as the POSIX bridge: a broken winsize probe must never
+# reach the resize call. ConPTY tolerates large values better than ioctl,
+# but we keep parity to avoid layout surprises.
+_MIN_DIMENSION = 1
+_MAX_COLS = 2000
+_MAX_ROWS = 1000
+
+
+def _clamp(value: int, maximum: int) -> int:
+    try:
+        n = int(value)
+    except (TypeError, ValueError, OverflowError):
+        return _MIN_DIMENSION
+    if n < _MIN_DIMENSION:
+        return _MIN_DIMENSION
+    if n > maximum:
+        return maximum
+    return n
+
+
+class PtyUnavailableError(RuntimeError):
+    """Raised when a PTY cannot be created on this platform."""
+
+
+class WinPtyBridge:
+    """pywinpty-backed bridge with the same interface as ``PtyBridge``.
+
+    ``web_server`` calls :meth:`read` inside ``run_in_executor``, so a
+    blocking/polling read here never stalls the event loop. ConPTY exposes
+    no selectable fd, so we poll with a short sleep instead of ``select``.
+    """
+
+    def __init__(self, proc: "PtyProcess") -> None:  # type: ignore[name-defined]
+        self._proc = proc
+        self._closed = False
+
+    # -- lifecycle --------------------------------------------------------
+
+    @classmethod
+    def is_available(cls) -> bool:
+        return bool(_PTY_AVAILABLE)
+
+    @classmethod
+    def spawn(
+        cls,
+        argv: Sequence[str],
+        *,
+        cwd: Optional[str] = None,
+        env: Optional[dict] = None,
+        cols: int = 80,
+        rows: int = 24,
+    ) -> "WinPtyBridge":
+        if not _PTY_AVAILABLE:
+            if PtyProcess is None:
+                raise PtyUnavailableError(
+                    "pywinpty is not installed. Install with: pip install pywinpty"
+                )
+            raise PtyUnavailableError("ConPTY is unavailable on this platform.")
+        spawn_env = (os.environ.copy() if env is None else dict(env))
+        if not spawn_env.get("TERM"):
+            spawn_env["TERM"] = "xterm-256color"
+        # pywinpty mirrors ptyprocess: dimensions=(rows, cols).
+        # This call shape is the one already used in tools/process_registry.py.
+        proc = PtyProcess.spawn(  # type: ignore[union-attr]
+            list(argv),
+            cwd=cwd,
+            env=spawn_env,
+            dimensions=(rows, cols),
+        )
+        return cls(proc)
+
+    @property
+    def pid(self) -> int:
+        return int(self._proc.pid)
+
+    def is_alive(self) -> bool:
+        if self._closed:
+            return False
+        try:
+            return bool(self._proc.isalive())
+        except Exception:
+            return False
+
+    # -- I/O --------------------------------------------------------------
+
+    def read(self, timeout: float = 0.2) -> Optional[bytes]:
+        """Up to 64 KiB of child output.
+
+        Returns bytes, ``b""`` when nothing is available this tick, or
+        ``None`` once the child has exited (EOF).
+        """
+        if self._closed:
+            return None
+        try:
+            data = self._proc.read(65536)  # pywinpty returns str
+        except EOFError:
+            return None
+        except Exception:
+            return None
+        if not data:
+            # No fd to select on; poll politely so the executor thread
+            # doesn't pin a core while the TUI is idle.
+            time.sleep(min(timeout, 0.02))
+            return b""
+        if isinstance(data, bytes):
+            return data
+        # NOTE: pywinpty decodes internally, so a multibyte UTF-8 sequence
+        # can in theory split across reads. xterm.js tolerates the rare
+        # replacement char; this is the one fidelity tradeoff vs the POSIX
+        # raw-fd path.
+        return data.encode("utf-8", errors="replace")
+
+    def write(self, data: bytes) -> None:
+        if self._closed or not data:
+            return
+        try:
+            # The dashboard sends raw keystroke bytes; pywinpty.write wants text.
+            self._proc.write(data.decode("utf-8", errors="replace"))
+        except Exception:
+            return
+
+    def resize(self, cols: int, rows: int) -> None:
+        if self._closed:
+            return
+        cols = _clamp(cols, _MAX_COLS)
+        rows = _clamp(rows, _MAX_ROWS)
+        try:
+            self._proc.setwinsize(rows, cols)  # pywinpty: (rows, cols)
+        except Exception:
+            pass
+
+    # -- teardown ---------------------------------------------------------
+
+    def close(self) -> None:
+        if self._closed:
+            return
+        self._closed = True
+        try:
+            self._proc.terminate(force=True)
+        except Exception:
+            pass
+
+    def __enter__(self) -> "WinPtyBridge":
+        return self
+
+    def __exit__(self, *_exc) -> None:
+        self.close()

package/agent/hermes_cli/write_approval_commands.py

@@ -0,0 +1,209 @@
+#!/usr/bin/env python3
+"""Shared handlers for the /memory and /skills write-approval subcommands.
+
+Both the interactive CLI (``cli.py``) and the gateway (``gateway/run.py``) call
+into this module so the pending-review UX (list / approve / reject / diff /
+mode) lives in one place. Each caller owns only its surface concerns:
+formatting the returned text and, for the gateway, persisting config + evicting
+the cached agent on a mode change.
+
+Every public handler returns a plain text string suitable for both a terminal
+and a chat message. Skill diffs are intentionally NOT inlined here — the
+``diff`` handler returns the full diff for the CLI pager, but on a messaging
+platform the gateway truncates it and points the user at the dashboard / file.
+"""
+
+from __future__ import annotations
+
+import json
+from typing import List, Optional
+
+from tools import write_approval as wa
+
+
+def _fmt_state(subsystem: str) -> str:
+    on = wa.write_approval_enabled(subsystem)
+    return f"{subsystem}.write_approval = {'on' if on else 'off'}"
+
+
+# ---------------------------------------------------------------------------
+# Formatting helpers
+# ---------------------------------------------------------------------------
+
+def _fmt_pending_list(subsystem: str) -> str:
+    records = wa.list_pending(subsystem)
+    if not records:
+        return f"No pending {subsystem} writes."
+    lines = [f"Pending {subsystem} writes ({len(records)}):"]
+    for r in records:
+        origin = r.get("origin", "foreground")
+        tag = " [auto]" if origin == "background_review" else ""
+        lines.append(f"  {r['id']}{tag}  {r.get('summary', '')}")
+    where = "/{s} approve <id>".format(s=subsystem)
+    lines.append("")
+    lines.append(f"Apply: {where}   Reject: /{subsystem} reject <id>")
+    if subsystem == wa.SKILLS:
+        lines.append("Review full diff: /skills diff <id>")
+    return "\n".join(lines)
+
+
+# ---------------------------------------------------------------------------
+# Subcommand dispatch
+# ---------------------------------------------------------------------------
+
+def handle_pending_subcommand(
+    subsystem: str,
+    args: List[str],
+    *,
+    memory_store=None,
+    set_mode_fn=None,
+) -> Optional[str]:
+    """Dispatch a /memory or /skills subcommand.
+
+    Args:
+        subsystem: ``memory`` or ``skills``.
+        args: tokens after the slash command (e.g. ``["approve", "a1b2"]``).
+        memory_store: live MemoryStore for applying approved memory writes
+            (CLI passes ``self.agent._memory_store``; gateway applies against a
+            freshly loaded store).
+        set_mode_fn: optional callable ``(enabled: bool) -> None`` that
+            persists the new write_approval boolean to config (gateway provides
+            this; CLI uses its own ``save_config_value`` and passes a closure).
+
+    Returns a text string to show the user. Returns None when the args are not
+    a write-approval subcommand (caller falls through to its other handling,
+    e.g. /skills search).
+    """
+    if not args:
+        # Bare /memory or /skills with no sub → show pending + gate state.
+        return f"{_fmt_state(subsystem)}\n\n" + _fmt_pending_list(subsystem)
+
+    sub = args[0].lower()
+    rest = args[1:]
+
+    if sub == "pending":
+        return _fmt_pending_list(subsystem)
+
+    if sub in {"approve", "apply"}:
+        return _approve(subsystem, rest, memory_store)
+
+    if sub in {"reject", "deny", "drop"}:
+        return _reject(subsystem, rest)
+
+    if sub == "diff" and subsystem == wa.SKILLS:
+        return _diff(rest)
+
+    if sub in {"approval", "mode"}:  # 'mode' kept as a back-compat alias
+        return _set_approval(subsystem, rest, set_mode_fn)
+
+    return None  # not ours — caller handles
+
+
+def _resolve_one(subsystem: str, rest: List[str]):
+    if not rest:
+        return None, f"Usage: /{subsystem} approve|reject <id>  (or 'all')"
+    return rest[0], None
+
+
+def _approve(subsystem: str, rest: List[str], memory_store) -> str:
+    target, err = _resolve_one(subsystem, rest)
+    if err or target is None:
+        return err or f"Usage: /{subsystem} approve <id>"
+
+    records = wa.list_pending(subsystem)
+    if not records:
+        return f"No pending {subsystem} writes."
+
+    if target.lower() == "all":
+        targets = list(records)
+    else:
+        rec = wa.get_pending(subsystem, target)
+        if not rec:
+            return f"No pending {subsystem} write with id '{target}'."
+        targets = [rec]
+
+    applied, failed = 0, []
+    for rec in targets:
+        ok, msg = _apply_one(subsystem, rec, memory_store)
+        if ok:
+            wa.discard_pending(subsystem, rec["id"])
+            applied += 1
+        else:
+            failed.append(f"{rec['id']}: {msg}")
+
+    out = [f"Approved {applied} {subsystem} write(s)."]
+    if failed:
+        out.append("Failed:")
+        out.extend(f"  {f}" for f in failed)
+    return "\n".join(out)
+
+
+def _apply_one(subsystem: str, rec, memory_store):
+    payload = rec.get("payload", {})
+    try:
+        if subsystem == wa.MEMORY:
+            if memory_store is None:
+                return False, "memory store unavailable"
+            from tools.memory_tool import apply_memory_pending
+            result = apply_memory_pending(payload, memory_store)
+            return bool(result.get("success")), result.get("error", "")
+        else:
+            from tools.skill_manager_tool import apply_skill_pending
+            result = json.loads(apply_skill_pending(payload))
+            return bool(result.get("success")), result.get("error", "")
+    except Exception as e:
+        return False, str(e)
+
+
+def _reject(subsystem: str, rest: List[str]) -> str:
+    target, err = _resolve_one(subsystem, rest)
+    if err or target is None:
+        return err or f"Usage: /{subsystem} reject <id>"
+    if target.lower() == "all":
+        n = 0
+        for rec in wa.list_pending(subsystem):
+            if wa.discard_pending(subsystem, rec["id"]):
+                n += 1
+        return f"Rejected {n} pending {subsystem} write(s)."
+    if wa.discard_pending(subsystem, target):
+        return f"Rejected pending {subsystem} write '{target}'."
+    return f"No pending {subsystem} write with id '{target}'."
+
+
+def _diff(rest: List[str]) -> str:
+    if not rest:
+        return "Usage: /skills diff <id>"
+    rec = wa.get_pending(wa.SKILLS, rest[0])
+    if not rec:
+        return f"No pending skill write with id '{rest[0]}'."
+    diff = wa.skill_pending_diff(rec)
+    header = f"# Pending skill write {rec['id']}: {rec.get('summary', '')}\n"
+    return header + "\n" + diff
+
+
+def _set_approval(subsystem: str, rest: List[str], set_mode_fn) -> str:
+    """Turn the approval gate on/off for a subsystem.
+
+    ``set_mode_fn`` (when provided) persists the new boolean to config.
+    """
+    if not rest:
+        return (f"{_fmt_state(subsystem)}\n"
+                f"Set with: /{subsystem} approval <on|off>")
+    arg = rest[0].strip().lower()
+    truthy = {"on", "true", "yes", "1", "enable", "enabled"}
+    falsey = {"off", "false", "no", "0", "disable", "disabled"}
+    if arg in truthy:
+        enabled = True
+    elif arg in falsey:
+        enabled = False
+    else:
+        return f"Invalid value '{arg}'. Use: on or off."
+    if set_mode_fn is None:
+        val = "true" if enabled else "false"
+        return (f"To change the {subsystem} approval gate, run:\n"
+                f"  hermes config set {subsystem}.write_approval {val}")
+    try:
+        set_mode_fn(enabled)
+    except Exception as e:
+        return f"Failed to set {subsystem}.write_approval: {e}"
+    return f"{subsystem}.write_approval set to '{'on' if enabled else 'off'}'."

package/agent/hermes_constants.py

@@ -5,6 +5,7 @@ without risk of circular imports.
 """
 
 import os
+import sys
 import sysconfig
 from contextvars import ContextVar, Token
 from pathlib import Path
@@ -40,17 +41,26 @@ def get_hermes_home_override() -> str | None:
     return str(override)
 
 
+def _get_platform_default_hermes_home() -> Path:
+    """Return the platform-native default Hermes home path."""
+    if sys.platform == "win32":
+        local_appdata = os.environ.get("LOCALAPPDATA", "").strip()
+        base = Path(local_appdata) if local_appdata else Path.home() / "AppData" / "Local"
+        return base / "hermes"
+    return Path.home() / ".hermes"
+
+
 def get_hermes_home() -> Path:
-    """Return the Hermes home directory (default: ~/.hermes).
+    """Return the Hermes home directory (default: platform-native path).
 
-    Reads HERMES_HOME env var, falls back to ~/.hermes.
+    Reads HERMES_HOME env var, falls back to the platform-native default.
     This is the single source of truth — all other copies should import this.
 
     When ``HERMES_HOME`` is unset but an ``active_profile`` file indicates
     a non-default profile is active, logs a loud one-shot warning to
     ``errors.log`` so cross-profile data corruption is diagnosable instead
     of silent.  Behavior is unchanged otherwise — we still return
-    ``~/.hermes`` — because raising here would brick 30+ module-level
+    the platform-native default — because raising here would brick 30+ module-level
     callers that import this at load time.  Subprocess spawners are
     expected to propagate ``HERMES_HOME`` explicitly (see the systemd
     template in ``hermes_cli/gateway.py`` and the kanban dispatcher in
@@ -69,10 +79,8 @@ def get_hermes_home() -> Path:
     global _profile_fallback_warned
     if not _profile_fallback_warned:
         try:
-            # Inline the default-root resolution from get_default_hermes_root()
-            # to stay import-safe (this function is called from module scope
-            # in 30+ files; we cannot afford to trigger logging setup here).
-            active_path = (Path.home() / ".hermes" / "active_profile")
+            fallback_home = _get_platform_default_hermes_home()
+            active_path = fallback_home / "active_profile"
             active = active_path.read_text().strip() if active_path.exists() else ""
         except (UnicodeDecodeError, OSError):
             active = ""
@@ -83,10 +91,9 @@ def get_hermes_home() -> Path:
             # module-import time from 30+ sites, often before logging is
             # configured, and (b) root-logger propagation would double-emit
             # on consoles where a StreamHandler is already attached.
-            import sys
             msg = (
                 f"[HERMES_HOME fallback] HERMES_HOME is unset but active "
-                f"profile is {active!r}. Falling back to ~/.hermes, which "
+                f"profile is {active!r}. Falling back to {fallback_home}, which "
                 f"is the DEFAULT profile — not {active!r}. Any data this "
                 f"process writes will land in the wrong profile. The "
                 f"subprocess spawner should pass HERMES_HOME explicitly "
@@ -98,13 +105,14 @@ def get_hermes_home() -> Path:
             except Exception:
                 pass
 
-    return Path.home() / ".hermes"
+    return _get_platform_default_hermes_home()
 
 
 def get_default_hermes_root() -> Path:
     """Return the root Hermes directory for profile-level operations.
 
-    In standard deployments this is ``~/.hermes``.
+    In standard deployments this is the platform-native Hermes home
+    (``~/.hermes`` on POSIX, ``%LOCALAPPDATA%\\hermes`` on native Windows).
 
     In Docker or custom deployments where ``HERMES_HOME`` points outside
     ``~/.hermes`` (e.g. ``/opt/data``), returns ``HERMES_HOME`` directly
@@ -117,7 +125,7 @@ def get_default_hermes_root() -> Path:
 
     Import-safe — no dependencies beyond stdlib.
     """
-    native_home = Path.home() / ".hermes"
+    native_home = _get_platform_default_hermes_home()
     env_home = os.environ.get("HERMES_HOME", "")
     if not env_home:
         return native_home
@@ -274,24 +282,20 @@ def secure_parent_dir(path: Path) -> None:
         pass
 
 
-def get_subprocess_home() -> str | None:
-    """Return a per-profile HOME directory for subprocesses, or None.
-
-    When ``{HERMES_HOME}/home/`` exists on disk, subprocesses should use it
-    as ``HOME`` so system tools (git, ssh, gh, npm …) write their configs
-    inside the Hermes data directory instead of the OS-level ``/root`` or
-    ``~/``.  This provides:
+def _norm_home_path(path: str | None) -> str:
+    """Return a comparable absolute path string, or ``""`` for empty input."""
+    raw = (path or "").strip()
+    if not raw:
+        return ""
+    try:
+        return os.path.normcase(os.path.abspath(os.path.expanduser(raw)))
+    except Exception:
+        return os.path.normcase(raw)
 
-    * **Docker persistence** — tool configs land inside the persistent volume.
-    * **Profile isolation** — each profile gets its own git identity, SSH
-      keys, gh tokens, etc.
 
-    The Python process's own ``os.environ["HOME"]`` and ``Path.home()`` are
-    **never** modified — only subprocess environments should inject this value.
-    Activation is directory-based: if the ``home/`` subdirectory doesn't
-    exist, returns ``None`` and behavior is unchanged.
-    """
-    hermes_home = get_hermes_home_override() or os.getenv("HERMES_HOME")
+def _profile_home_path(env: dict[str, str] | None = None) -> str | None:
+    """Return ``{HERMES_HOME}/home`` when the profile-home directory exists."""
+    hermes_home = get_hermes_home_override() or (env or {}).get("HERMES_HOME") or os.getenv("HERMES_HOME")
     if not hermes_home:
         return None
     profile_home = os.path.join(hermes_home, "home")
@@ -300,6 +304,107 @@ def get_subprocess_home() -> str | None:
     return None
 
 
+def _is_profile_home(candidate: str | None, profile_home: str | None) -> bool:
+    return bool(candidate and profile_home and _norm_home_path(candidate) == _norm_home_path(profile_home))
+
+
+def _iter_real_home_candidates(env: dict[str, str] | None = None) -> list[str]:
+    """Return likely OS-user home candidates in trust order."""
+    env = env or {}
+    candidates: list[str] = []
+    explicit = str(env.get("HERMES_REAL_HOME") or os.getenv("HERMES_REAL_HOME", "")).strip()
+    if explicit:
+        candidates.append(explicit)
+    home = str(env.get("HOME") or os.getenv("HOME", "")).strip()
+    if home:
+        candidates.append(home)
+    try:
+        import pwd
+
+        pw_home = pwd.getpwuid(os.getuid()).pw_dir.strip()  # windows-footgun: ok — POSIX-only module inside try/except
+        if pw_home:
+            candidates.append(pw_home)
+    except Exception:
+        pass
+    userprofile = str(env.get("USERPROFILE") or os.getenv("USERPROFILE", "")).strip()
+    if userprofile:
+        candidates.append(userprofile)
+    drive = str(env.get("HOMEDRIVE") or os.getenv("HOMEDRIVE", "")).strip()
+    path = str(env.get("HOMEPATH") or os.getenv("HOMEPATH", "")).strip()
+    if drive and path:
+        candidates.append(f"{drive}{path}" if path.startswith(("\\", "/")) else os.path.join(drive, path))
+    expanded = os.path.expanduser("~")
+    if expanded and expanded != "~":
+        candidates.append(expanded)
+    return candidates
+
+
+def get_real_home(env: dict[str, str] | None = None) -> str:
+    """Return the OS user's real home directory, avoiding Hermes profile HOME.
+
+    ``HERMES_HOME`` scopes Hermes state. ``HOME`` is reserved for the OS/user
+    account and the many external CLIs that store credentials under ``~``.
+    If a parent process is already running with ``HOME={HERMES_HOME}/home``,
+    this helper repairs back to the account home when possible.
+    """
+    profile_home = _profile_home_path(env)
+    seen: set[str] = set()
+    for candidate in _iter_real_home_candidates(env):
+        key = _norm_home_path(candidate)
+        if not key or key in seen:
+            continue
+        seen.add(key)
+        if not _is_profile_home(candidate, profile_home):
+            return candidate
+    return "/tmp"
+
+
+def get_subprocess_home(env: dict[str, str] | None = None) -> str | None:
+    """Return a subprocess ``HOME`` override, if one should be applied.
+
+    Policy is controlled by ``terminal.home_mode`` (bridged to
+    ``TERMINAL_HOME_MODE``):
+
+    * ``auto`` (default): host installs keep the real user HOME; containers use
+      ``{HERMES_HOME}/home`` for persistent state. If a host parent already has
+      HOME pointed at the profile home, repair subprocesses back to real HOME.
+    * ``real``: always prefer the real OS-user HOME.
+    * ``profile``: use ``{HERMES_HOME}/home`` when it exists, preserving the
+      older strict per-profile tool-config isolation.
+    """
+    env = env or {}
+    profile_home = _profile_home_path(env)
+    mode = str(env.get("TERMINAL_HOME_MODE") or os.getenv("TERMINAL_HOME_MODE", "auto")).strip().lower() or "auto"
+    if mode in {"isolated", "profile_home", "profile-home"}:
+        mode = "profile"
+    if mode in {"host", "user", "real_home", "real-home"}:
+        mode = "real"
+
+    if mode == "profile":
+        return profile_home
+
+    real_home = get_real_home(env)
+    current_home = str(env.get("HOME") or os.getenv("HOME", "")).strip()
+    if mode == "real":
+        return real_home if _norm_home_path(real_home) != _norm_home_path(current_home) else None
+
+    if profile_home and is_container():
+        return profile_home
+    if _is_profile_home(current_home, profile_home):
+        return real_home if _norm_home_path(real_home) != _norm_home_path(current_home) else None
+    return None
+
+
+def apply_subprocess_home_env(env: dict[str, str]) -> None:
+    """Apply Hermes' subprocess HOME contract to *env* in-place."""
+    real_home = get_real_home(env)
+    if real_home:
+        env["HERMES_REAL_HOME"] = real_home
+    home = get_subprocess_home(env)
+    if home:
+        env["HOME"] = home
+
+
 VALID_REASONING_EFFORTS = ("minimal", "low", "medium", "high", "xhigh")
 
 
@@ -356,11 +461,21 @@ _container_detected: bool | None = None
 
 
 def is_container() -> bool:
-    """Return True when running inside a Docker/Podman container.
+    """Return True when running inside a container.
 
-    Checks ``/.dockerenv`` (Docker), ``/run/.containerenv`` (Podman),
-    and ``/proc/1/cgroup`` for container runtime markers.  Result is
-    cached for the process lifetime.  Import-safe — no heavy deps.
+    Recognizes Docker (``/.dockerenv``), Podman (``/run/.containerenv``),
+    and — via ``/proc/1/cgroup`` — the docker/podman/lxc cgroup-v1 markers.
+
+    cgroup v2 collapses ``/proc/1/cgroup`` to a single ``0::/`` line with no
+    runtime marker, so containerd/CRI-O runtimes (the common case on
+    Kubernetes/k3s) were previously missed. To cover those, also check:
+      * ``KUBERNETES_SERVICE_HOST`` env var — set in every Kubernetes pod.
+      * ``kubepods`` / ``containerd`` / ``crio`` markers in ``/proc/1/cgroup``.
+      * the same markers in ``/proc/self/mountinfo`` (cgroup-v2 fallback).
+
+    Result is cached for the process lifetime.  Import-safe — no heavy deps.
+
+    See: NousResearch/hermes-agent#47111
     """
     global _container_detected
     if _container_detected is not None:
@@ -371,10 +486,26 @@ def is_container() -> bool:
     if os.path.exists("/run/.containerenv"):
         _container_detected = True
         return True
+    # Kubernetes always injects this into pod containers; absent on hosts.
+    if os.environ.get("KUBERNETES_SERVICE_HOST"):
+        _container_detected = True
+        return True
+    _CGROUP_MARKERS = ("docker", "podman", "/lxc/", "kubepods", "containerd", "crio")
     try:
         with open("/proc/1/cgroup", "r", encoding="utf-8") as f:
             cgroup = f.read()
-            if "docker" in cgroup or "podman" in cgroup or "/lxc/" in cgroup:
+            if any(marker in cgroup for marker in _CGROUP_MARKERS):
+                _container_detected = True
+                return True
+    except OSError:
+        pass
+    # cgroup v2: /proc/1/cgroup is just "0::/" with no marker. The container
+    # runtime still shows up in the mount table (overlay rootfs, runtime mount
+    # paths), so scan mountinfo as a last resort.
+    try:
+        with open("/proc/self/mountinfo", "r", encoding="utf-8") as f:
+            mountinfo = f.read()
+            if any(marker in mountinfo for marker in ("kubepods", "containerd", "crio")):
                 _container_detected = True
                 return True
     except OSError: