5 · Approval and Safety Red Lines ★

tools/approval.py, 5,802 lines. This is the single file in the whole project with the densest adversarial thinking.

5.1 The Overall Structure

5.2 The 12 Hard Red Lines

HARDLINE_PATTERNS = [
  # rm recursively deleting the root filesystem or a protected root directory
  (_RM_FLAG_PREFIX + _hardline_rm_path(r'/(?:(?:\.\.?)?/)*(?:\.\.?)?\**|/ \*'),
                                          "recursive delete of root filesystem"),
  (_RM_FLAG_PREFIX + _hardline_rm_path(_HARDLINE_SYSTEM_DIRS),
                                          "recursive delete of system directory"),
  (_RM_FLAG_PREFIX + _hardline_rm_path(r'(?:~|\$\{?HOME\}?)(?:/?|/\*)?'),
                                          "recursive delete of home directory"),
  # formatting a filesystem
  (_CMDPOS + r'mkfs(\.[a-z0-9]+)?\b',     "format filesystem (mkfs)"),
  # writing straight to a raw disk device
  (_CMDPOS + r'dd\b[^\n]*\bof=/dev/(sd|nvme|hd|mmcblk|vd|xvd)[a-z0-9]*',
                                          "dd to raw block device"),
  (r'>\s*/dev/(sd|nvme|hd|mmcblk|vd|xvd)[a-z0-9]*\b',
                                          "redirect to raw block device"),
  # fork bomb: a process that replicates itself endlessly and locks up the machine
  (r':\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:',        "fork bomb"),
  # killing every process on the system
  (_CMDPOS + r'kill\s+(-[^\s]+\s+)*-1\b', "kill all processes"),
  # shutdown / reboot (four spellings)
  (_CMDPOS + r'(shutdown|reboot|halt|poweroff)\b',      "system shutdown/reboot"),
  (_CMDPOS + r'init\s+[06]\b',                          "init 0/6"),
  (_CMDPOS + r'systemctl\s+(poweroff|reboot|halt|kexec)\b', "systemctl poweroff/reboot"),
  (_CMDPOS + r'telinit\s+[06]\b',                       "telinit 0/6"),
]

_HARDLINE_SYSTEM_DIRS = (
    r'/home|/home/\*|/root|/root/\*|/etc|/etc/\*|/usr|/usr/\*|'
    r'/var|/var/\*|/bin|/bin/\*|/sbin|/sbin/\*|/boot|/boot/\*|/lib|/lib/\*'
)

hermes-agent/tools/approval.py

“Unconditional” means: nothing the user configures matters; these commands will never be executed.

5.3 The Real Difficulty: Telling “Command” from “Data”

A real incident

The most naive implementation is if "rm -rf /" in command: block. A source comment records the problem it caused:

The solution: command-position anchoring

_CMDPOS = (
    # start of line / after a command separator / after a subshell opener / after a sudo|env|exec wrapper
    ...
)

# rm plus its flag group, shared by the three rm rules. Kept as plain string concatenation
# (rather than an f-string) so the regex's backslashes never appear inside an f-string
# replacement field — which is unsupported on Python 3.11.
_RM_FLAG_PREFIX = _CMDPOS + r'rm\s+(-[^\s]*\s+)*'

_CMDPOS matches only in these positions:

In --title "block rm -rf / spellings", what precedes rm is a space and a quote, which is none of the positions above — so there's no match, and the command runs normally.

Path normalization: which spellings actually mean the root directory

The regex in that root-directory rule is /(?:(?:\.\.?)?/)*(?:\.\.?)?\**|/ \*, and the comment explains its design:

The comment also notes: “the explicit "/ \*" branch preserves the ‘slash-space-glob’ spelling (rm -rf / *, which the shell sees as two arguments: / and the glob *)” — a classic slip-of-the-finger disaster (you meant to delete /tmp/* and typed one extra space).

5.4 Quote Masking: But Leave a Way In for “the Part That Really Executes”

Two of the red-line rules have no command name to anchor on — the redirect > /dev/sda and the fork bomb's function definition are effective at any position on the command line.

_QUOTE_MASKED_HARDLINE_DESCRIPTIONS = frozenset({
    "redirect to raw block device",
    "fork bomb",
})

HARDLINE_PATTERNS_COMPILED = [
    (re.compile(pattern, _RE_FLAGS),
     description,
     description in _QUOTE_MASKED_HARDLINE_DESCRIPTIONS)     # ★ third field: whether to mask
    for pattern, description in HARDLINE_PATTERNS
]

The exact semantics of the masking function

def _mask_quoted_prose(command: str) -> str:
    """Blank out quoted string CONTENT for positionless hardline matching.

    Detection-only rewrite used by the quote-masked hardline rules
    (redirect-to-block-device, fork bomb): text inside single or double
    quotes is data the shell passes as an argument, so `echo "cat f >
    /dev/sda"` must not trip the unconditional floor. Structure is
    preserved: the quote characters themselves stay, and inside double
    quotes `$(...)` command substitutions and backtick spans are kept RAW
    because the shell really executes them (`echo "$(cat f > /dev/sda)"`
    remains a true positive). Unquoted text is untouched.
    """

In plain terms: for the positionless red-line rules, blank out the content inside quotes. This is a rewrite used only for detection… quoted text is data the shell passes as an argument, so echo "cat f > /dev/sda" must not hit the unconditional red line. Structure is preserved: the quote characters themselves stay, and inside double quotes, $(...) command substitutions and backtick spans are left unmasked, because the shell really does execute them. Unquoted text is untouched.

5.5 Quoting Is Not a Bypass

_SHELL_CARRIER_NAMES = frozenset({
    "eval", "sh", "bash", "zsh", "ksh", "dash", "source", ".",
})

def _contains_shell_carrier(command: str) -> bool:
    """Return whether any command-position word is a shell-carrying command."""
    for _, _, word in _iter_shell_command_word_spans(command):
        name = os.path.basename(
            _deobfuscate_shell_word_for_detection(word)     # ★ de-obfuscation
        ).lower()
        if name in _SHELL_CARRIER_NAMES:
            return True
    return False

The logic: if the command contains something like sh -c "...", bash -c "...", or eval "..." — a command that “hands quoted content to another shell to execute” — then what's inside the quotes is code, not prose. The masking rule is switched off entirely, and the raw string must be scanned.

The comment sums it up in one line: “quoting is not a bypass”.

Three layers of defense, stacked

And de-obfuscation

_deobfuscate_shell_word_for_detection handles spellings like these:

5.6 Sensitive Paths and Write Targets

Beyond dangerous commands, there is a set of patterns for writes to sensitive files:

_SSH_SENSITIVE_PATH   = r'(?:~|\$home|\$\{home\})/\.ssh(?:/|$)'
_HERMES_ENV_PATH      = ...        # ~/.hermes/.env (the agent's own credentials)
_HERMES_CONFIG_PATH   = ...        # ~/.hermes/config.yaml (the agent's own configuration)
_PROJECT_ENV_PATH     = r'(?:(?:/|\.{1,2}/)?(?:[^\s/"\'`]+/)*\.env(?:\.[^/\s"\'`]+)*)'
_PROJECT_CONFIG_PATH  = r'(?:(?:/|\.{1,2}/)?(?:[^\s/"\'`]+/)*config\.yaml)'
_SHELL_RC_FILES       = (...)      # .bashrc / .zshrc and other shell startup scripts
_CREDENTIAL_FILES     = (...)
_MACOS_PRIVATE_SYSTEM_PATH = r'/private/(?:etc|var|tmp|home)/'
_SYSTEM_CONFIG_PATH   = (...)

_SENSITIVE_WRITE_TARGET         = (...)
_USER_SENSITIVE_WRITE_TARGET    = (...)
_PROJECT_SENSITIVE_WRITE_TARGET = rf'(?:{_PROJECT_ENV_PATH}|{_PROJECT_CONFIG_PATH})'

_COMMAND_TAIL           = r'(?:\s*(?:&&|\|\||;).*)?$'
_WRITE_TARGET_BOUNDARY  = r'(?=[\s;&|<>"\']|$)'

Two other regexes deserve attention:

• _COMMAND_TAIL — matches the case where “more commands follow this one” (&&, ||, ;). Prevents spellings like echo ok && rm -rf / that hide the dangerous command at the end.
• _WRITE_TARGET_BOUNDARY — a lookahead assertion requiring the write target to be followed by whitespace, a separator, or end of line. Prevents .env from falsely matching a different file like .envrc.

5.7 The sudo Stdin Guard

_SUDO_STDIN_RE = re.compile(...)
def _check_sudo_stdin_guard(command: str) -> tuple: ...
def _sudo_stdin_block_result(description: str) -> dict: ...

This defends against spellings like echo PASSWORD | sudo -S DANGEROUS_COMMAND — sudo -S means “read the password from standard input,” so the password can be piped in, bypassing the interactive password prompt entirely.

And the interactive password prompt was supposed to be the last human gate. Bypassing it means the agent can run arbitrary privileged commands without the user ever knowing.

5.8 Performance: Why Precompile

# Building these at module load eliminates the ~2.6 ms cold-cache re.compile fan-out
# on each process's first terminal() call
# (12 HARDLINE + 47 DANGEROUS patterns, any of which can be evicted from Python's
#  512-entry re._cache by unrelated regex work elsewhere in the program).
_RE_FLAGS = re.IGNORECASE | re.DOTALL
HARDLINE_PATTERNS_COMPILED = [...]

Two layers of problem:

1. First-compile cost — 59 regexes compiled on first use, about 2.6 milliseconds
2. Cache eviction — Python's built-in regex cache holds only 512 entries. Whenever the rest of the program gets busy (log formatting, text processing), these safety regexes get evicted, causing repeated recompilation

Precompiled into module-level constants, both problems disappear.

5.9 Retaining Blocked Commands

def _save_blocked_payload(command: str) -> Optional[str]: ...
def _hardline_block_result(description: str, command: str = "") -> dict: ...
def _user_deny_block_result(pattern: str) -> dict: ...

_save_blocked_payload stores the commands that got blocked. Two uses:

• Forensics — if an attack really happened, you can trace what the attacker tried to execute
• False-positive analysis — if a user complains “a normal command got blocked,” you can see exactly which rule matched what

5.10 Smart Approval: An Optional Model Judgment

def _prepare_smart_approval_observer(...)
def _observe_smart_approval_verdict(payload: dict | None, verdict: str) -> None
def _fire_approval_hook(hook_name: str, **kwargs) -> None

Beyond the deterministic rules, Hermes has an optional “smart approval” — using a model to judge whether an operation is safe.

Note the words observer and verdict in the function names: the mechanism is designed to be observable, and every verdict is recorded. That is what makes it possible to evaluate “how accurate is smart approval, and what did it get wrong.”

5.11 Context Awareness: Different Situations, Different Policies

def set_hermes_interactive_context(interactive: bool) -> contextvars.Token
def reset_hermes_interactive_context(token: contextvars.Token) -> None
def _is_interactive_cli() -> bool
def _is_cron_approval_context() -> bool
def _is_single_query_approval_context() -> bool
def _is_gateway_approval_context() -> bool
def _get_session_platform() -> str
def _resolve_cli_approval_callback(approval_callback=None)
def _should_fall_through_to_cli_approval(...)

def set_current_session_key(session_key: str) -> contextvars.Token[str]
def get_current_session_key(default: str = "default") -> str
def set_current_observability_context(...)

This uses Python's contextvars — a variable mechanism that “propagates automatically through an async call chain, with each coroutine isolated from the others.”

And the policy differences across situations are:

5.12 Where This Layer Sits: Outermost, and Thinnest