Summary

Extend pre_tool_call hooks to support {"action": "approve"} directive, allowing plugins to override built-in approval checks (e.g., dangerous command detection). Also adds "plugin" approval mode.

What changed

• hermes_cli/plugins.py:

  • Rename get_pre_tool_call_block_message() → get_pre_tool_call_directive()
  • Return tuple (directive, message) where directive is "block", "approve", or None

• tools/terminal_tool.py:

  • Check for "approve" directive before security checks
  • Skip dangerous-command guard when plugin approves

• tools/approval.py:

  • Add "plugin" to documented approval modes
  • Return early with {"approved": True, "plugin_mode": True} when in plugin mode

• tests/: Updated for new function signature

How to test

# Plugin that approves specific commands
def my_pre_tool_call(hook_name, **kwargs):
    if hook_name == "pre_tool_call":
        tool = kwargs.get("tool_name")
        args = kwargs.get("args", {})
        if tool == "terminal" and "echo" in args.get("command", ""):
            return {"action": "approve", "message": "Echo is safe"}
    return []

# Set approval mode to plugin
# In config.yaml: approvals: {mode: "plugin"}

Platforms tested

• macOS (Darwin 25.3.0)

Related

• Builds on existing {"action": "block"} mechanism
• See feat: pre_tool_call hook should support REJECT semantics (10-line patch) #9388 for pre_tool_call hook discussion

Closes #11812