feat(approval): env-gated reboot/shutdown downgrade (HERMES_ALLOW_REBOOT)#38976
Open
Kyzcreig wants to merge 1 commit into
Open
feat(approval): env-gated reboot/shutdown downgrade (HERMES_ALLOW_REBOOT)#38976Kyzcreig wants to merge 1 commit into
Kyzcreig wants to merge 1 commit into
Conversation
…OOT) The reboot/shutdown family is on the unconditional hardline blocklist — the correct default for most agents, but a hard blocker for fleet/ops agents that legitimately need to restart the Linux hosts they manage. Add an opt-in escape hatch: when HERMES_ALLOW_REBOOT is set truthy, the reboot/shutdown family downgrades from HARDLINE to the DANGEROUS layer — still approval-gated, and yolo / approvals.mode=off can pass it through. Every other catastrophic pattern (root recursive delete, filesystem format, raw-device overwrite, fork bomb, kill -1) stays unconditionally hardline. Default (flag unset) is byte-identical to the historical always-block behavior. Verified: 129 tests pass including new downgrade and isolation tests.
Kyzcreig
added a commit
to Kyzcreig/hermes-agent
that referenced
this pull request
Jun 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The reboot/shutdown family is on the unconditional hardline blocklist in
tools/approval.py— blocked even under--yolo,approvals.mode=off, and cron approve mode. That's the right default for most agents, but it's a hard wall for fleet/ops agents that legitimately manage Linux hosts and need to restart them.This adds a narrow, opt-in escape hatch.
What changed
HERMES_ALLOW_REBOOTenv flag (default unset).shutdown|reboot|halt|poweroff,init 0/6,systemctl poweroff/reboot,telinit 0/6) downgrades out of the hardline floor into the existingDANGEROUS_PATTERNSlayer. It is then approval-gated like any other dangerous command, and--yolo/approvals.mode=offcan pass it through.kill -1. The flag only touches the reboot/shutdown family.Why this design
_REBOOT_HARDLINE_DESCS) is downgraded; the rest of the hardline floor is untouched.Tests
tests/tools/test_hardline_blocklist.py— added:0,false,no, empty) stay blocked129 passed(existing hardline suite + new tests), no regressions.